From 50a17a11a7928662009a0616f4dbf66f6f781f7d Mon Sep 17 00:00:00 2001 From: Shikanime Deva Date: Fri, 26 Jun 2026 15:03:58 +0200 Subject: [PATCH 1/5] refactor(user-tokens): migrate from server Signed-off-by: William Phetsinorath Change-Id: Ib1b5cbbfcd8274912ed9ffb20d60cbed6a6a6964 --- apps/server-nestjs/src/main.module.ts | 4 + .../admin-token/admin-token-queries.utils.ts | 80 ++++++++ .../admin-token/admin-token.controller.ts | 36 ++++ .../modules/admin-token/admin-token.module.ts | 12 ++ .../admin-token/admin-token.service.spec.ts | 129 +++++++++++++ .../admin-token/admin-token.service.ts | 90 +++++++++ .../modules/admin-token/admin-token.utils.ts | 9 + .../clean-types/controller-body.types.ts | 12 ++ .../project-bulk/project-bulk.controller.ts | 3 +- .../project-bulk/project-bulk.service.ts | 4 +- .../project-roles/project-roles.controller.ts | 5 +- .../modules/project/project-testing.utils.ts | 3 +- .../src/modules/project/project.controller.ts | 5 +- .../src/modules/project/project.service.ts | 7 +- .../user-tokens/user-tokens-queries.utils.ts | 51 +++++ .../user-tokens/user-tokens.controller.ts | 39 ++++ .../modules/user-tokens/user-tokens.module.ts | 12 ++ .../user-tokens/user-tokens.service.spec.ts | 130 +++++++++++++ .../user-tokens/user-tokens.service.ts | 81 ++++++++ .../modules/user-tokens/user-tokens.utils.ts | 9 + apps/server-nestjs/src/utils/crypto.spec.ts | 73 +++++++- apps/server-nestjs/src/utils/crypto.ts | 40 +++- apps/server-nestjs/src/utils/schemas.ts | 8 + .../test/admin-token.e2e-spec.ts | 144 ++++++++++++++ .../test/user-tokens.e2e-spec.ts | 175 ++++++++++++++++++ 25 files changed, 1146 insertions(+), 15 deletions(-) create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.ts create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token.module.ts create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token.service.ts create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token.utils.ts create mode 100644 apps/server-nestjs/src/modules/infrastructure/clean-types/controller-body.types.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens.utils.ts create mode 100644 apps/server-nestjs/src/utils/schemas.ts create mode 100644 apps/server-nestjs/test/admin-token.e2e-spec.ts create mode 100644 apps/server-nestjs/test/user-tokens.e2e-spec.ts diff --git a/apps/server-nestjs/src/main.module.ts b/apps/server-nestjs/src/main.module.ts index adcd9691a1..4fdab5c0cd 100644 --- a/apps/server-nestjs/src/main.module.ts +++ b/apps/server-nestjs/src/main.module.ts @@ -1,5 +1,6 @@ import { Module } from '@nestjs/common' import { ScheduleModule } from '@nestjs/schedule' +import { AdminTokenModule } from './modules/admin-token/admin-token.module' import { DeploymentModule } from './modules/deployment/deployment.module' import { EnvironmentModule } from './modules/environment/environment.module' import { HealthzModule } from './modules/healthz/healthz.module' @@ -15,11 +16,13 @@ import { ProjectServicesModule } from './modules/project-services/project-servic import { ProjectModule } from './modules/project/project.module' import { ServiceChainModule } from './modules/service-chain/service-chain.module' import { SystemSettingsModule } from './modules/system-settings/system-settings.module' +import { UserTokensModule } from './modules/user-tokens/user-tokens.module' import { VersionModule } from './modules/version/version.module' @Module({ imports: [ InfrastructureModule, + AdminTokenModule, HealthzModule, KeycloakModule, ScheduleModule.forRoot(), @@ -35,6 +38,7 @@ import { VersionModule } from './modules/version/version.module' LogModule, DeploymentModule, EnvironmentModule, + UserTokensModule, VersionModule, ], controllers: [], diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.ts b/apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.ts new file mode 100644 index 0000000000..41d07061c8 --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.ts @@ -0,0 +1,80 @@ +import type { Prisma } from '@prisma/client' + +export const adminTokenOwnerSelect = { + id: true, + email: true, + firstName: true, + lastName: true, + type: true, +} satisfies Prisma.UserSelect + +export const adminTokenSelect = { + id: true, + name: true, + permissions: true, + lastUse: true, + expirationDate: true, + status: true, + createdAt: true, + userId: true, + owner: { + select: adminTokenOwnerSelect, + }, +} satisfies Prisma.AdminTokenSelect + +export type AdminTokenRecord = Prisma.AdminTokenGetPayload<{ + select: typeof adminTokenSelect +}> + +export function listAdminTokens(tx: Prisma.TransactionClient, withRevoked: boolean) { + const where: Prisma.AdminTokenWhereInput = withRevoked + ? { status: { in: ['active', 'revoked'] } } + : { status: 'active' } + + return tx.adminToken.findMany({ + where, + select: adminTokenSelect, + orderBy: [{ status: 'asc' }, { createdAt: 'asc' }], + }) +} + +export function createBotUser(tx: Prisma.TransactionClient, data: { botUserId: string, name: string }) { + return tx.user.create({ + data: { + firstName: 'Bot Admin', + lastName: data.name, + type: 'bot', + id: data.botUserId, + email: `${data.botUserId}@bot.io`, + }, + }) +} + +export function createAdminToken(tx: Prisma.TransactionClient, data: { + name: string + permissions: bigint + expirationDate: Date | null + hash: string + userId: string +}) { + return tx.adminToken.create({ + data: { + name: data.name, + permissions: data.permissions, + expirationDate: data.expirationDate, + hash: data.hash, + userId: data.userId, + }, + select: adminTokenSelect, + }) +} + +export function revokeAdminToken(tx: Prisma.TransactionClient, id: string) { + return tx.adminToken.updateMany({ + where: { id }, + data: { + status: 'revoked', + expirationDate: new Date(), + }, + }) +} diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts new file mode 100644 index 0000000000..c56fca5447 --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token.controller.ts @@ -0,0 +1,36 @@ +import type { CreateAdminTokenBody } from './admin-token.utils' +import { CoerceBooleanSchema } from '@cpn-console/shared' +import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Inject, Param, ParseUUIDPipe, Post, Query, UseGuards } from '@nestjs/common' +import { RequireAdminPermission } from '../infrastructure/permission/user/user-admin-permission.decorator' +import { UserGuard } from '../infrastructure/permission/user/user.guard' +import { ZodValidationPipe } from '../infrastructure/pipe/zod-validation.pipe' +import { AdminTokenService } from './admin-token.service' +import { CreateAdminTokenBodySchema } from './admin-token.utils' + +@Controller('api/v1/admin/tokens') +@UseGuards(UserGuard) +export class AdminTokenController { + constructor(@Inject(AdminTokenService) private readonly service: AdminTokenService) {} + + @Get() + @RequireAdminPermission('ListAdminToken') + async list(@Query('withRevoked', new ZodValidationPipe(CoerceBooleanSchema)) withRevoked?: boolean) { + return this.service.list(withRevoked === true) + } + + @Post() + @HttpCode(HttpStatus.CREATED) + @RequireAdminPermission('ManageAdminToken') + async create( + @Body(new ZodValidationPipe(CreateAdminTokenBodySchema)) data: CreateAdminTokenBody, + ) { + return this.service.create(data) + } + + @Delete(':tokenId') + @HttpCode(HttpStatus.NO_CONTENT) + @RequireAdminPermission('ManageAdminToken') + async revoke(@Param('tokenId', ParseUUIDPipe) tokenId: string): Promise { + return this.service.revoke(tokenId) + } +} diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.module.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.module.ts new file mode 100644 index 0000000000..176543d961 --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token.module.ts @@ -0,0 +1,12 @@ +import { Module } from '@nestjs/common' +import { InfrastructureModule } from '../infrastructure/infrastructure.module' +import { AdminTokenController } from './admin-token.controller' +import { AdminTokenService } from './admin-token.service' + +@Module({ + imports: [InfrastructureModule], + controllers: [AdminTokenController], + providers: [AdminTokenService], + exports: [AdminTokenService], +}) +export class AdminTokenModule {} diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts new file mode 100644 index 0000000000..45976f73af --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token.service.spec.ts @@ -0,0 +1,129 @@ +import type { TestingModule } from '@nestjs/testing' +import type { DeepMockProxy } from 'vitest-mock-extended' +import { faker } from '@faker-js/faker' +import { Test } from '@nestjs/testing' +import { beforeEach, describe, expect, it } from 'vitest' +import { mockDeep } from 'vitest-mock-extended' +import { PrismaService } from '../infrastructure/database/prisma.service' +import { AdminTokenService } from './admin-token.service' +import { CreateAdminTokenBodySchema } from './admin-token.utils' + +describe('adminTokenService', () => { + let module: TestingModule + let service: AdminTokenService + let prisma: DeepMockProxy + + beforeEach(async () => { + prisma = mockDeep() + + module = await Test.createTestingModule({ + providers: [ + AdminTokenService, + { provide: PrismaService, useValue: prisma }, + ], + }).compile() + + service = module.get(AdminTokenService) + }) + + describe('list', () => { + it('returns active tokens with permissions serialized as string', async () => { + const tokenId = faker.string.uuid() + const userId = faker.string.uuid() + prisma.adminToken.findMany.mockResolvedValue([{ + id: tokenId, + name: 'my-token', + permissions: 4n, + lastUse: null, + expirationDate: null, + status: 'active' as const, + createdAt: faker.date.past(), + userId, + hash: 'hash-1', + }]) + + const result = await service.list() + + expect(prisma.adminToken.findMany).toHaveBeenCalled() + expect(result).toHaveLength(1) + expect(result[0].id).toBe(tokenId) + expect(result[0].permissions).toBe('4') + }) + + it('includes revoked tokens when withRevoked is true', async () => { + prisma.adminToken.findMany.mockResolvedValue([]) + + await service.list(true) + + const callArgs = prisma.adminToken.findMany.mock.calls[0]?.[0] + expect(callArgs?.where).toEqual({ status: { in: ['active', 'revoked'] } }) + }) + + it('filters to active only by default', async () => { + prisma.adminToken.findMany.mockResolvedValue([]) + + await service.list() + + const callArgs = prisma.adminToken.findMany.mock.calls[0]?.[0] + expect(callArgs?.where).toEqual({ status: 'active' }) + }) + }) + + describe('create', () => { + it('rejects a non-parseable expirationDate via the body schema', () => { + const result = CreateAdminTokenBodySchema.safeParse({ name: 'x', permissions: '4', expirationDate: 'not-a-date' }) + expect(result.success).toBe(false) + }) + + it('rejects an expirationDate that is too soon via the body schema', () => { + const today = faker.date.recent() + const result = CreateAdminTokenBodySchema.safeParse({ name: 'x', permissions: '4', expirationDate: today.toISOString() }) + expect(result.success).toBe(false) + }) + + it('returns created token with plaintext password and serialized permissions', async () => { + const tokenId = faker.string.uuid() + const botUserId = faker.string.uuid() + const tx = mockDeep() + tx.user.create.mockResolvedValue({ id: botUserId, firstName: 'Bot Admin', lastName: 'my-token', type: 'bot', email: 'x@bot.io' } as never) + tx.adminToken.create.mockResolvedValue({ + id: tokenId, + name: 'my-token', + permissions: 2n, + lastUse: null, + expirationDate: null, + status: 'active' as const, + createdAt: faker.date.past(), + userId: botUserId, + hash: 'hash-2', + }) + prisma.$transaction.mockImplementation(async fn => fn(tx)) + + const result = await service.create({ name: 'my-token', permissions: '2', expirationDate: null }) + + expect(prisma.$transaction).toHaveBeenCalledWith(expect.any(Function)) + expect(tx.user.create).toHaveBeenCalled() + expect(tx.adminToken.create).toHaveBeenCalled() + expect(result.id).toBe(tokenId) + expect(result.password).toBeTruthy() + expect(result.permissions).toBe('2') + }) + }) + + describe('revoke', () => { + it('sets status to revoked and expiration date to now', async () => { + const tokenId = faker.string.uuid() + prisma.adminToken.updateMany.mockResolvedValue({ count: 1 } as never) + + await service.revoke(tokenId) + + expect(prisma.adminToken.updateMany).toHaveBeenCalledWith({ + where: { id: tokenId }, + data: { + status: 'revoked', + expirationDate: expect.any(Date) as Date, + }, + }) + }) + }) +}) diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.service.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.service.ts new file mode 100644 index 0000000000..0a4b28d2a1 --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token.service.ts @@ -0,0 +1,90 @@ +import type { CreateAdminTokenBody } from './admin-token.utils' +import { randomUUID } from 'node:crypto' +import { Inject, Injectable, Logger } from '@nestjs/common' +import { trace } from '@opentelemetry/api' +import { generateTokenPair } from '../../utils/crypto' +import { ExpirationDateSchema } from '../../utils/schemas.js' +import { PrismaService } from '../infrastructure/database/prisma.service' +import { StartActiveSpan } from '../infrastructure/telemetry/telemetry.decorator' +import { + createAdminToken, + createBotUser, + listAdminTokens, + revokeAdminToken, +} from './admin-token-queries.utils' + +@Injectable() +export class AdminTokenService { + private readonly logger = new Logger(AdminTokenService.name) + + constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {} + + @StartActiveSpan() + async list(withRevoked = false) { + const span = trace.getActiveSpan() + this.logger.debug(`adminToken.list requested (withRevoked=${withRevoked})`) + span?.setAttribute('adminToken.list.withRevoked', withRevoked) + + const tokens = await listAdminTokens(this.prisma, withRevoked) + + span?.setAttribute('adminToken.list.count', tokens.length) + this.logger.debug(`adminToken.list completed (count=${tokens.length})`) + + return tokens.map(({ permissions, ...token }) => ({ + ...token, + permissions: permissions.toString(), + })) + } + + @StartActiveSpan() + async create(data: CreateAdminTokenBody) { + const span = trace.getActiveSpan() + span?.setAttribute('adminToken.create.name', data.name) + this.logger.debug(`adminToken.create started (tokenName=${data.name})`) + + const expirationDate = data.expirationDate + ? ExpirationDateSchema.parse(data.expirationDate) + : null + + try { + const { password, hash } = await generateTokenPair() + + const token = await this.prisma.$transaction(async (tx) => { + const botUserId = randomUUID() + await createBotUser(tx, { botUserId, name: data.name }) + return createAdminToken(tx, { + name: data.name, + permissions: BigInt(data.permissions), + expirationDate, + hash, + userId: botUserId, + }) + }) + + span?.setAttribute('adminToken.create.tokenId', token.id) + this.logger.log(`adminToken.create completed (adminTokenId=${token.id}, botUserId=${token.userId}, status=${token.status})`) + return { + ...token, + password, + permissions: token.permissions.toString(), + } + } catch (error) { + this.logger.error( + `adminToken.create failed (tokenName=${data.name}): ${error instanceof Error ? error.message : String(error)}`, + error instanceof Error ? error.stack : undefined, + ) + throw error + } + } + + @StartActiveSpan() + async revoke(id: string) { + const span = trace.getActiveSpan() + span?.setAttribute('adminToken.revoke.tokenId', id) + this.logger.debug(`adminToken.revoke started (adminTokenId=${id})`) + + await revokeAdminToken(this.prisma, id) + + this.logger.log(`adminToken.revoke completed (adminTokenId=${id})`) + } +} diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token.utils.ts b/apps/server-nestjs/src/modules/admin-token/admin-token.utils.ts new file mode 100644 index 0000000000..0059f24e99 --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token.utils.ts @@ -0,0 +1,9 @@ +import type { z } from 'zod' +import { AdminTokenSchema } from '@cpn-console/shared' +import { ExpirationDateSchema } from '../../utils/schemas.js' + +export const CreateAdminTokenBodySchema = AdminTokenSchema + .pick({ name: true, permissions: true, expirationDate: true }) + .extend({ expirationDate: ExpirationDateSchema.nullable() }) + .required() +export type CreateAdminTokenBody = z.infer diff --git a/apps/server-nestjs/src/modules/infrastructure/clean-types/controller-body.types.ts b/apps/server-nestjs/src/modules/infrastructure/clean-types/controller-body.types.ts new file mode 100644 index 0000000000..ce62a5a9f7 --- /dev/null +++ b/apps/server-nestjs/src/modules/infrastructure/clean-types/controller-body.types.ts @@ -0,0 +1,12 @@ +import type { + projectContract, + projectRoleContract, +} from '@cpn-console/shared' +import type { ClientInferRequest } from '@ts-rest/core' + +export type CreateProjectBody = ClientInferRequest['body'] +export type UpdateProjectBody = ClientInferRequest['body'] +export type BulkActionProjectBody = ClientInferRequest['body'] + +export type CreateProjectRoleBody = ClientInferRequest['body'] +export type PatchProjectRolesBody = ClientInferRequest['body'] diff --git a/apps/server-nestjs/src/modules/project-bulk/project-bulk.controller.ts b/apps/server-nestjs/src/modules/project-bulk/project-bulk.controller.ts index 82874da42d..664753a1b8 100644 --- a/apps/server-nestjs/src/modules/project-bulk/project-bulk.controller.ts +++ b/apps/server-nestjs/src/modules/project-bulk/project-bulk.controller.ts @@ -1,5 +1,6 @@ import type { FastifyRequest } from 'fastify' import type { UserContext } from '../infrastructure/auth/auth-user.decorator' +import type { BulkActionProjectBody } from '../infrastructure/clean-types/controller-body.types' import { projectContract } from '@cpn-console/shared' import { Body, Controller, HttpCode, HttpStatus, Inject, Logger, Post, Req, UseGuards } from '@nestjs/common' import { AuthUser } from '../infrastructure/auth/auth-user.decorator' @@ -21,7 +22,7 @@ export class ProjectBulkController { @UseGuards(UserGuard) @RequireAdminPermission('Manage') async bulkAction( - @Body(new ZodValidationPipe(projectContract.bulkActionProject.body)) body: typeof projectContract.bulkActionProject.body._type, + @Body(new ZodValidationPipe(projectContract.bulkActionProject.body)) body: BulkActionProjectBody, @AuthUser() user: UserContext, @Req() request: FastifyRequest, ): Promise { diff --git a/apps/server-nestjs/src/modules/project-bulk/project-bulk.service.ts b/apps/server-nestjs/src/modules/project-bulk/project-bulk.service.ts index 5989764d17..42d8057efc 100644 --- a/apps/server-nestjs/src/modules/project-bulk/project-bulk.service.ts +++ b/apps/server-nestjs/src/modules/project-bulk/project-bulk.service.ts @@ -1,4 +1,4 @@ -import type { projectContract } from '@cpn-console/shared' +import type { BulkActionProjectBody } from '../infrastructure/clean-types/controller-body.types' import { Inject, Injectable, Logger } from '@nestjs/common' import { trace } from '@opentelemetry/api' import { PrismaService } from '../infrastructure/database/prisma.service' @@ -19,7 +19,7 @@ export class ProjectBulkService { @StartActiveSpan() async bulkAction( - data: typeof projectContract.bulkActionProject.body._type, + data: BulkActionProjectBody, requestorUserId?: string, requestId?: string, ): Promise { diff --git a/apps/server-nestjs/src/modules/project-roles/project-roles.controller.ts b/apps/server-nestjs/src/modules/project-roles/project-roles.controller.ts index c7fb6a706d..13168d0e9f 100644 --- a/apps/server-nestjs/src/modules/project-roles/project-roles.controller.ts +++ b/apps/server-nestjs/src/modules/project-roles/project-roles.controller.ts @@ -1,3 +1,4 @@ +import type { CreateProjectRoleBody, PatchProjectRolesBody } from '../infrastructure/clean-types/controller-body.types' import type { ProjectContext } from '../infrastructure/permission/project/project.guard' import { projectRoleContract } from '@cpn-console/shared' import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Inject, Param, Patch, Post, UseGuards } from '@nestjs/common' @@ -30,7 +31,7 @@ export class ProjectRolesController { @RequireProjectLocked(false) @RequireProjectPermission('ManageRoles') async create( - @Body(new ZodValidationPipe(projectRoleContract.createProjectRole.body)) body: typeof projectRoleContract.createProjectRole.body._type, + @Body(new ZodValidationPipe(projectRoleContract.createProjectRole.body)) body: CreateProjectRoleBody, @Project() project: ProjectContext, ) { return this.projectRoles.create(project.id, body) @@ -42,7 +43,7 @@ export class ProjectRolesController { @RequireProjectLocked(false) @RequireProjectPermission('ManageRoles') async update( - @Body(new ZodValidationPipe(projectRoleContract.patchProjectRoles.body)) body: typeof projectRoleContract.patchProjectRoles.body._type, + @Body(new ZodValidationPipe(projectRoleContract.patchProjectRoles.body)) body: PatchProjectRolesBody, @Project() project: ProjectContext, ) { return this.projectRoles.update(project.id, body) diff --git a/apps/server-nestjs/src/modules/project/project-testing.utils.ts b/apps/server-nestjs/src/modules/project/project-testing.utils.ts index 4205b88470..ccac4a8921 100644 --- a/apps/server-nestjs/src/modules/project/project-testing.utils.ts +++ b/apps/server-nestjs/src/modules/project/project-testing.utils.ts @@ -1,5 +1,6 @@ import type { projectContract } from '@cpn-console/shared' import type { Prisma, ProjectMembers, User } from '@prisma/client' +import type { CreateProjectBody } from '../infrastructure/clean-types/controller-body.types' import type { ProjectContext } from '../infrastructure/permission/project/project.guard' import type { projectSelect, ProjectWithDetails } from './project-queries.utils' import { PROJECT_PERMS } from '@cpn-console/shared' @@ -138,7 +139,7 @@ export function makeProjectWithMembersResult( return { ...project, members } as ProjectWithMembers } -export function makeCreateProjectBody(overrides: Partial = {}): typeof projectContract.createProject.body._type { +export function makeCreateProjectBody(overrides: Partial = {}): CreateProjectBody { return { name: faker.string.alphanumeric({ length: faker.number.int({ min: 2, max: 20 }) }).toLowerCase(), description: faker.lorem.sentence(), diff --git a/apps/server-nestjs/src/modules/project/project.controller.ts b/apps/server-nestjs/src/modules/project/project.controller.ts index a10afe449f..e673cf3b05 100644 --- a/apps/server-nestjs/src/modules/project/project.controller.ts +++ b/apps/server-nestjs/src/modules/project/project.controller.ts @@ -1,6 +1,7 @@ import type { ProjectV2 } from '@cpn-console/shared' import type { FastifyRequest } from 'fastify' import type { UserContext } from '../infrastructure/auth/auth-user.decorator' +import type { CreateProjectBody, UpdateProjectBody } from '../infrastructure/clean-types/controller-body.types' import type { ProjectContext } from '../infrastructure/permission/project/project.guard' import { AdminAuthorized, projectContract } from '@cpn-console/shared' import { Body, Controller, Delete, ForbiddenException, Get, HttpCode, HttpStatus, Inject, Post, Put, Query, Req, UseGuards } from '@nestjs/common' @@ -47,7 +48,7 @@ export class ProjectController { @UseGuards(UserGuard) @RequireAdminPermission('ManageProjects') async create( - @Body(new ZodValidationPipe(projectContract.createProject.body)) body: typeof projectContract.createProject.body._type, + @Body(new ZodValidationPipe(projectContract.createProject.body)) body: CreateProjectBody, @AuthUser() user: UserContext, @Req() request: FastifyRequest, ): Promise { @@ -69,7 +70,7 @@ export class ProjectController { @RequireProjectStatus('initializing', 'created', 'failed', 'warning') @RequireProjectPermission('Manage') async update( - @Body(new ZodValidationPipe(projectContract.updateProject.body)) data: typeof projectContract.updateProject.body._type, + @Body(new ZodValidationPipe(projectContract.updateProject.body)) data: UpdateProjectBody, @Project() project: ProjectContext, @AuthUser() user: UserContext, @Req() request: FastifyRequest, diff --git a/apps/server-nestjs/src/modules/project/project.service.ts b/apps/server-nestjs/src/modules/project/project.service.ts index 533be11806..47916effd1 100644 --- a/apps/server-nestjs/src/modules/project/project.service.ts +++ b/apps/server-nestjs/src/modules/project/project.service.ts @@ -1,6 +1,7 @@ import type { projectContract } from '@cpn-console/shared' import type { Prisma } from '@prisma/client' import type { UserContext } from '../infrastructure/auth/auth-user.decorator' +import type { CreateProjectBody, UpdateProjectBody } from '../infrastructure/clean-types/controller-body.types' import type { ProjectDataExport, ProjectUpdateContext, ProjectWithDetails } from './project-queries.utils' import { AdminAuthorized } from '@cpn-console/shared' import { BadRequestException, ForbiddenException, Inject, Injectable, InternalServerErrorException, Logger, NotFoundException } from '@nestjs/common' @@ -89,7 +90,7 @@ export class ProjectService { @StartActiveSpan() async create( - body: typeof projectContract.createProject.body._type, + body: CreateProjectBody, requestorUserId: string, requestId?: string, ): Promise { @@ -133,7 +134,7 @@ export class ProjectService { } async update( - body: typeof projectContract.updateProject.body._type, + body: UpdateProjectBody, user: UserContext, projectId: string, requestId?: string, @@ -265,7 +266,7 @@ export class ProjectService { } private stripProjectUpdateBody( - body: typeof projectContract.updateProject.body._type, + body: UpdateProjectBody, user: UserContext, project: ProjectUpdateContext, ): { effectiveData: Record, strippedKeys: string[] } { diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts new file mode 100644 index 0000000000..a9ba48fadb --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.ts @@ -0,0 +1,51 @@ +import type { Prisma } from '@prisma/client' + +export const userTokenOwnerSelect = { + id: true, + email: true, + firstName: true, + lastName: true, + type: true, +} satisfies Prisma.UserSelect + +export const userTokenSelect = { + id: true, + name: true, + lastUse: true, + expirationDate: true, + status: true, + createdAt: true, + userId: true, + owner: { + select: userTokenOwnerSelect, + }, +} satisfies Prisma.PersonalAccessTokenSelect + +export type UserTokenRecord = Prisma.PersonalAccessTokenGetPayload<{ + select: typeof userTokenSelect +}> + +export function listUserTokens(tx: Prisma.TransactionClient, userId: string) { + return tx.personalAccessToken.findMany({ + where: { userId }, + orderBy: [{ status: 'asc' }, { createdAt: 'asc' }], + select: userTokenSelect, + }) +} + +export function createUserToken(tx: Prisma.TransactionClient, data: { + name: string + expirationDate: Date + hash: string + userId: string +}) { + return tx.personalAccessToken.create({ + data: { + name: data.name, + hash: data.hash, + expirationDate: data.expirationDate, + userId: data.userId, + }, + select: userTokenSelect, + }) +} diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts new file mode 100644 index 0000000000..e4811a1d85 --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.controller.ts @@ -0,0 +1,39 @@ +import type { UserContext } from '../infrastructure/auth/auth-user.decorator' +import type { CreatePersonalAccessTokenBody } from './user-tokens.utils' +import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Inject, Param, ParseUUIDPipe, Post, UseGuards } from '@nestjs/common' +import { AuthUser } from '../infrastructure/auth/auth-user.decorator' +import { RequireUserType } from '../infrastructure/permission/user/user-type.decorator' +import { UserGuard } from '../infrastructure/permission/user/user.guard' +import { ZodValidationPipe } from '../infrastructure/pipe/zod-validation.pipe' +import { UserTokensService } from './user-tokens.service' +import { CreatePersonalAccessTokenBodySchema } from './user-tokens.utils' + +@Controller('api/v1/user/tokens') +@UseGuards(UserGuard) +@RequireUserType('human') +export class UserTokensController { + constructor(@Inject(UserTokensService) private readonly service: UserTokensService) {} + + @Get() + async list(@AuthUser() user: UserContext) { + return this.service.list(user.userId) + } + + @Post() + @HttpCode(HttpStatus.CREATED) + async create( + @Body(new ZodValidationPipe(CreatePersonalAccessTokenBodySchema)) data: CreatePersonalAccessTokenBody, + @AuthUser() user: UserContext, + ) { + return this.service.create(data, user.userId) + } + + @Delete(':tokenId') + @HttpCode(HttpStatus.NO_CONTENT) + async delete( + @Param('tokenId', ParseUUIDPipe) tokenId: string, + @AuthUser() user: UserContext, + ): Promise { + return this.service.delete(tokenId, user.userId) + } +} diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts new file mode 100644 index 0000000000..af7a0028ba --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.module.ts @@ -0,0 +1,12 @@ +import { Module } from '@nestjs/common' +import { InfrastructureModule } from '../infrastructure/infrastructure.module' +import { UserTokensController } from './user-tokens.controller' +import { UserTokensService } from './user-tokens.service' + +@Module({ + imports: [InfrastructureModule], + controllers: [UserTokensController], + providers: [UserTokensService], + exports: [UserTokensService], +}) +export class UserTokensModule {} diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts new file mode 100644 index 0000000000..7570ea7817 --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.spec.ts @@ -0,0 +1,130 @@ +import type { TestingModule } from '@nestjs/testing' +import type { DeepMockProxy } from 'vitest-mock-extended' +import { faker } from '@faker-js/faker' +import { Test } from '@nestjs/testing' +import { beforeEach, describe, expect, it } from 'vitest' +import { mockDeep } from 'vitest-mock-extended' +import { PrismaService } from '../infrastructure/database/prisma.service' +import { userTokenSelect } from './user-tokens-queries.utils' +import { UserTokensService } from './user-tokens.service' +import { CreatePersonalAccessTokenBodySchema } from './user-tokens.utils' + +describe('userTokensService', () => { + let module: TestingModule + let service: UserTokensService + let prisma: DeepMockProxy + + beforeEach(async () => { + prisma = mockDeep() + + module = await Test.createTestingModule({ + providers: [ + UserTokensService, + { provide: PrismaService, useValue: prisma }, + ], + }).compile() + + service = module.get(UserTokensService) + }) + + describe('list', () => { + it('returns user tokens ordered by status then creation date', async () => { + const userId = faker.string.uuid() + const tokenId = faker.string.uuid() + prisma.personalAccessToken.findMany.mockResolvedValue([{ + id: tokenId, + name: 'my-token', + lastUse: null, + expirationDate: faker.date.future(), + status: 'active' as const, + createdAt: faker.date.past(), + userId, + hash: 'hash-1', + }]) + + const result = await service.list(userId) + + expect(prisma.personalAccessToken.findMany).toHaveBeenCalledWith( + expect.objectContaining({ where: { userId } }), + ) + expect(result).toHaveLength(1) + expect(result[0].id).toBe(tokenId) + }) + + it('selects only exposed token fields', async () => { + const userId = faker.string.uuid() + prisma.personalAccessToken.findMany.mockResolvedValue([]) + + await service.list(userId) + + const callArgs = prisma.personalAccessToken.findMany.mock.calls[0]?.[0] + expect(callArgs?.select).toEqual(userTokenSelect) + }) + }) + + describe('create', () => { + it('rejects a non-parseable expirationDate via the body schema', () => { + const result = CreatePersonalAccessTokenBodySchema.safeParse({ name: 'x', expirationDate: 'not-a-date' }) + expect(result.success).toBe(false) + }) + + it('rejects an expirationDate that is too soon via the body schema', () => { + const today = faker.date.recent() + const result = CreatePersonalAccessTokenBodySchema.safeParse({ name: 'x', expirationDate: today.toISOString() }) + expect(result.success).toBe(false) + }) + + it('returns created token with plaintext password', async () => { + const userId = faker.string.uuid() + const tokenId = faker.string.uuid() + prisma.personalAccessToken.create.mockResolvedValue({ + id: tokenId, + name: 'my-token', + lastUse: null, + expirationDate: faker.date.future(), + status: 'active' as const, + createdAt: faker.date.past(), + userId, + hash: 'hash-2', + }) + + const result = await service.create({ name: 'my-token', expirationDate: faker.date.future() }, userId) + + expect(prisma.personalAccessToken.create).toHaveBeenCalledWith( + expect.objectContaining({ + data: expect.objectContaining({ + userId, + name: 'my-token', + }), + select: userTokenSelect, + }), + ) + expect(result.id).toBe(tokenId) + expect(result.password).toBeTruthy() + }) + }) + + describe('delete', () => { + it('deletes token scoped to its owner in a single atomic call', async () => { + const tokenId = faker.string.uuid() + const userId = faker.string.uuid() + prisma.personalAccessToken.deleteMany.mockResolvedValue({ count: 1 }) + + await service.delete(tokenId, userId) + + expect(prisma.personalAccessToken.deleteMany).toHaveBeenCalledWith({ + where: { id: tokenId, userId }, + }) + }) + + it('no-ops (count 0) when token is missing or belongs to another user', async () => { + prisma.personalAccessToken.deleteMany.mockResolvedValue({ count: 0 }) + + await service.delete('unknown', 'user-1') + + expect(prisma.personalAccessToken.deleteMany).toHaveBeenCalledWith({ + where: { id: 'unknown', userId: 'user-1' }, + }) + }) + }) +}) diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts new file mode 100644 index 0000000000..f7ed376616 --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.service.ts @@ -0,0 +1,81 @@ +import type { CreatePersonalAccessTokenBody } from './user-tokens.utils' +import { Inject, Injectable, Logger } from '@nestjs/common' +import { trace } from '@opentelemetry/api' +import { generateTokenPair } from '../../utils/crypto' +import { ExpirationDateSchema } from '../../utils/schemas.js' +import { PrismaService } from '../infrastructure/database/prisma.service' +import { StartActiveSpan } from '../infrastructure/telemetry/telemetry.decorator' +import { createUserToken, listUserTokens } from './user-tokens-queries.utils' + +@Injectable() +export class UserTokensService { + private readonly logger = new Logger(UserTokensService.name) + + constructor(@Inject(PrismaService) private readonly prisma: PrismaService) {} + + @StartActiveSpan() + async list(userId: string) { + const span = trace.getActiveSpan() + span?.setAttribute('userTokens.list.userId', userId) + this.logger.log(`userTokens.list requested (userId=${userId})`) + + const tokens = await listUserTokens(this.prisma, userId) + + span?.setAttribute('userTokens.list.count', tokens.length) + this.logger.log(`userTokens.list completed (userId=${userId}, count=${tokens.length})`) + return tokens + } + + @StartActiveSpan() + async create(data: CreatePersonalAccessTokenBody, userId: string) { + const span = trace.getActiveSpan() + span?.setAttribute('userTokens.create.name', data.name) + span?.setAttribute('userTokens.create.userId', userId) + this.logger.log(`userTokens.create started (tokenName=${data.name}, userId=${userId})`) + + const expirationDate = ExpirationDateSchema.parse(data.expirationDate) + + try { + const { password, hash } = await generateTokenPair() + + const token = await createUserToken(this.prisma, { + ...data, + hash, + userId, + expirationDate, + }) + + span?.setAttribute('userTokens.create.tokenId', token.id) + this.logger.log(`userTokens.create completed (tokenId=${token.id}, userId=${userId})`) + + return { + ...token, + password, + } + } catch (error) { + this.logger.error( + `userTokens.create failed (tokenName=${data.name}, userId=${userId}): ${error instanceof Error ? error.message : String(error)}`, + error instanceof Error ? error.stack : undefined, + ) + throw error + } + } + + @StartActiveSpan() + async delete(tokenId: string, userId: string): Promise { + const span = trace.getActiveSpan() + span?.setAttribute('userTokens.delete.tokenId', tokenId) + span?.setAttribute('userTokens.delete.userId', userId) + this.logger.log(`userTokens.delete started (tokenId=${tokenId}, userId=${userId})`) + + const { count } = await this.prisma.personalAccessToken.deleteMany({ + where: { id: tokenId, userId }, + }) + + if (count > 0) { + this.logger.log(`userTokens.delete completed (tokenId=${tokenId})`) + } else { + this.logger.log(`userTokens.delete skipped (tokenId=${tokenId}, reason=notFoundOrNotOwner)`) + } + } +} diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens.utils.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens.utils.ts new file mode 100644 index 0000000000..d90189e960 --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens.utils.ts @@ -0,0 +1,9 @@ +import type { z } from 'zod' +import { PersonalAccessTokenSchema } from '@cpn-console/shared' +import { ExpirationDateSchema } from '../../utils/schemas.js' + +export const CreatePersonalAccessTokenBodySchema = PersonalAccessTokenSchema + .pick({ name: true, expirationDate: true }) + .extend({ expirationDate: ExpirationDateSchema }) + .required() +export type CreatePersonalAccessTokenBody = z.infer diff --git a/apps/server-nestjs/src/utils/crypto.spec.ts b/apps/server-nestjs/src/utils/crypto.spec.ts index 19bad4e44c..7418793275 100644 --- a/apps/server-nestjs/src/utils/crypto.spec.ts +++ b/apps/server-nestjs/src/utils/crypto.spec.ts @@ -1,6 +1,7 @@ +import { createHash } from 'node:crypto' import { generateProjectKey as legacyGenerateProjectKey } from '@cpn-console/hooks' import { describe, expect, it } from 'vitest' -import { generateProjectKey } from './crypto' +import { generateProjectKey, generateTokenPair, verifyTokenHash } from './crypto' describe('generateProjectKey', () => { it('matches the legacy @cpn-console/hooks implementation byte-for-byte', () => { @@ -31,3 +32,73 @@ describe('generateProjectKey', () => { expect(generateProjectKey('my-app', 'front-api')).not.toBe(generateProjectKey('my-app-front', 'api')) }) }) + +describe('generateTokenPair', () => { + it('returns a plaintext token and a sha256 hex hash', async () => { + const { password, hash } = await generateTokenPair() + + expect(password).toHaveLength(48) + expect(password).toMatch(/^[a-z0-9-]+$/i) + expect(hash).toMatch(/^[0-9a-f]{64}$/) + }) + + it('honours a custom length', async () => { + const { password, hash } = await generateTokenPair(64) + + expect(password).toHaveLength(64) + expect(hash).toMatch(/^[0-9a-f]{64}$/) + }) + + it('produces distinct tokens on each call', async () => { + const first = await generateTokenPair() + const second = await generateTokenPair() + + expect(first.password).not.toBe(second.password) + expect(first.hash).not.toBe(second.hash) + }) + + it('does not embed the plaintext token in the hash', async () => { + const { password, hash } = await generateTokenPair() + + expect(hash).not.toContain(password) + }) + + it('round-trips: the generated hash verifies the plaintext token', async () => { + const { password, hash } = await generateTokenPair() + + expect(await verifyTokenHash(password, hash)).toBe(true) + }) +}) + +describe('verifyTokenHash', () => { + it('accepts a 64-char lowercase hex sha256 digest of the token', async () => { + const token = 'some-plaintext-token' + const hash = createHash('sha256').update(token).digest('hex') + + expect(await verifyTokenHash(token, hash)).toBe(true) + }) + + it('rejects a malformed (non-hex) hash', async () => { + const token = 'some-plaintext-token' + + expect(await verifyTokenHash(token, 'not-a-valid-sha-hash')).toBe(false) + }) + + it('rejects the sha256 of a different token', async () => { + const hash = createHash('sha256').update('other-token').digest('hex') + + expect(await verifyTokenHash('some-plaintext-token', hash)).toBe(false) + }) + + it('rejects an empty hash', async () => { + const { password } = await generateTokenPair() + + expect(await verifyTokenHash(password, '')).toBe(false) + }) + + it('rejects an unrecognised format', async () => { + const { password } = await generateTokenPair() + + expect(await verifyTokenHash(password, 'not-a-sha-hash')).toBe(false) + }) +}) diff --git a/apps/server-nestjs/src/utils/crypto.ts b/apps/server-nestjs/src/utils/crypto.ts index f12bebcd13..c419d46c6a 100644 --- a/apps/server-nestjs/src/utils/crypto.ts +++ b/apps/server-nestjs/src/utils/crypto.ts @@ -1,7 +1,6 @@ -import crypto, { createHmac } from 'node:crypto' +import crypto, { createHash, createHmac, timingSafeEqual } from 'node:crypto' -export function generateRandomPassword(length = 24) { - const chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@-_#*' +export function generateRandomPassword(length = 24, chars = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!@-_#*') { return Array.from(crypto.getRandomValues(new Uint32Array(length)), x => chars[x % chars.length]) .join('') } @@ -16,3 +15,38 @@ export function generateProjectKey(projectSlug: string, internalRepoName: string .slice(0, 4) return `${projectSlug}-${internalRepoName}-${repoHash}` } + +const TOKEN_ALPHABET = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-' +const TOKEN_LENGTH = 48 + +export interface TokenPair { + /** Plaintext token. Returned to the caller once and never stored. */ + password: string + /** SHA-256 hex digest of the token (64 lowercase hex chars). */ + hash: string +} + +/** + * Generate a secure random access token and its SHA-256 storage hash. + * The plaintext token is shown to the caller exactly once; only the hash is + * persisted. This keeps the storage format compatible with the Fastify server + * (unsalted `sha256(token)` hex digest). + */ +export function generateTokenPair(length: number = TOKEN_LENGTH): TokenPair { + const password = generateRandomPassword(length, TOKEN_ALPHABET) + const hash = createHash('sha256').update(password).digest('hex') + return { password, hash } +} + +/** + * Verify a plaintext token against a stored SHA-256 hex hash + * (64 lowercase hex chars, unsalted — the format shared with the Fastify server). + * Uses a constant-time comparison to avoid timing leaks. + */ +export async function verifyTokenHash(token: string, storedHash: string): Promise { + if (!/^[0-9a-f]{64}$/.test(storedHash)) return false + + const expected = Buffer.from(storedHash, 'hex') + const derived = createHash('sha256').update(token).digest() + return expected.length === derived.length && timingSafeEqual(expected, derived) +} diff --git a/apps/server-nestjs/src/utils/schemas.ts b/apps/server-nestjs/src/utils/schemas.ts new file mode 100644 index 0000000000..18e34777ff --- /dev/null +++ b/apps/server-nestjs/src/utils/schemas.ts @@ -0,0 +1,8 @@ +import { z } from 'zod' + +export const ExpirationDateSchema = z.coerce.date() + .refine((value) => { + const tomorrow = new Date(Date.now()) + tomorrow.setUTCHours(23, 59, 59, 999) + return value.getTime() > tomorrow.getTime() + }, { message: 'Date d\'expiration trop courte' }) diff --git a/apps/server-nestjs/test/admin-token.e2e-spec.ts b/apps/server-nestjs/test/admin-token.e2e-spec.ts new file mode 100644 index 0000000000..ed4a9532ee --- /dev/null +++ b/apps/server-nestjs/test/admin-token.e2e-spec.ts @@ -0,0 +1,144 @@ +import type { TestingModule } from '@nestjs/testing' +import { faker } from '@faker-js/faker' +import { Test } from '@nestjs/testing' +import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest' +import { AdminTokenModule } from '../src/modules/admin-token/admin-token.module' +import { AdminTokenService } from '../src/modules/admin-token/admin-token.service' +import { PrismaService } from '../src/modules/infrastructure/database/prisma.service' + +const canRunAdminTokenE2E = Boolean(process.env.E2E) && Boolean(process.env.DB_URL) + +const describeWithAdminToken = describe.runIf(canRunAdminTokenE2E) + +describeWithAdminToken('AdminTokenService (e2e)', () => { + let moduleRef: TestingModule + let service: AdminTokenService + let prisma: PrismaService + + const createdTokenIds: string[] = [] + const createdBotUserIds: string[] = [] + + beforeAll(async () => { + moduleRef = await Test.createTestingModule({ + imports: [AdminTokenModule], + }).compile() + + await moduleRef.init() + + service = moduleRef.get(AdminTokenService) + prisma = moduleRef.get(PrismaService) + }) + + afterAll(async () => { + if (prisma) { + await prisma.adminToken.deleteMany({ where: { id: { in: createdTokenIds } } }).catch(() => {}) + await prisma.user.deleteMany({ where: { id: { in: createdBotUserIds } } }).catch(() => {}) + } + + await moduleRef?.close() + vi.restoreAllMocks() + vi.unstubAllEnvs() + }) + + it('should create a bot user and issue a token with plaintext password', async () => { + const result = await service.create({ + name: `e2e-admin-${faker.string.uuid()}`, + permissions: String(1n << 16n), + expirationDate: null, + }) + + expect(result.id).toBeTruthy() + expect(result.password).toBeTruthy() + expect(result.password.length).toBe(48) + expect(result.name).toMatch(/^e2e-admin-/) + expect(result.status).toBe('active') + expect(result.permissions).toBe(String(1n << 16n)) + + createdTokenIds.push(result.id) + if (result.owner?.id) { + createdBotUserIds.push(result.owner.id) + } + }) + + it('should list active tokens by default and include revoked when requested', async () => { + const tokenName = `e2e-admin-${faker.string.uuid()}` + const created = await service.create({ + name: tokenName, + permissions: String(1n << 16n), + expirationDate: null, + }) + createdTokenIds.push(created.id) + if (created.owner?.id) createdBotUserIds.push(created.owner.id) + + const activeOnly = await service.list(false) + expect(activeOnly.some(t => t.id === created.id)).toBe(true) + expect(activeOnly.every(t => t.status === 'active')).toBe(true) + + const withRevoked = await service.list(true) + expect(withRevoked.length).toBeGreaterThanOrEqual(activeOnly.length) + }) + + it('should revoke a token and exclude it from active list', async () => { + const created = await service.create({ + name: `e2e-revoke-${faker.string.uuid()}`, + permissions: String(1n << 16n), + expirationDate: null, + }) + createdTokenIds.push(created.id) + if (created.owner?.id) createdBotUserIds.push(created.owner.id) + + await service.revoke(created.id) + + const activeOnly = await service.list(false) + expect(activeOnly.some(t => t.id === created.id)).toBe(false) + + const withRevoked = await service.list(true) + const revokedToken = withRevoked.find(t => t.id === created.id) + expect(revokedToken).toBeTruthy() + expect(revokedToken?.status).toBe('revoked') + }) + + it('should reject creation with expiration date in the past', async () => { + const yesterday = new Date(Date.now() - 86400000) + await expect(service.create({ + name: `e2e-expired-${faker.string.uuid()}`, + permissions: '0', + expirationDate: yesterday, + })).rejects.toThrow('Date d\'expiration trop courte') + }) + + it('should persist a sha256 hash of the password in DB', async () => { + const created = await service.create({ + name: `e2e-hash-${faker.string.uuid()}`, + permissions: String(1n << 16n), + expirationDate: null, + }) + createdTokenIds.push(created.id) + if (created.owner?.id) createdBotUserIds.push(created.owner.id) + + const stored = await prisma.adminToken.findUniqueOrThrow({ + where: { id: created.id }, + select: { hash: true }, + }) + + expect(stored.hash).toMatch(/^[0-9a-f]{64}$/) + expect(stored.hash).not.toContain(created.password) + }) + + it('should omit hash from API responses', async () => { + const created = await service.create({ + name: `e2e-omit-${faker.string.uuid()}`, + permissions: String(1n << 16n), + expirationDate: null, + }) + createdTokenIds.push(created.id) + if (created.owner?.id) createdBotUserIds.push(created.owner.id) + + expect(created).not.toHaveProperty('hash') + + const listed = await service.list(true) + const found = listed.find(t => t.id === created.id) + expect(found).toBeTruthy() + expect(found).not.toHaveProperty('hash') + }) +}) diff --git a/apps/server-nestjs/test/user-tokens.e2e-spec.ts b/apps/server-nestjs/test/user-tokens.e2e-spec.ts new file mode 100644 index 0000000000..10cd2ff95b --- /dev/null +++ b/apps/server-nestjs/test/user-tokens.e2e-spec.ts @@ -0,0 +1,175 @@ +import type { TestingModule } from '@nestjs/testing' +import { createHash } from 'node:crypto' +import { faker } from '@faker-js/faker' +import { Test } from '@nestjs/testing' +import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest' +import { PrismaService } from '../src/modules/infrastructure/database/prisma.service' +import { UserTokensModule } from '../src/modules/user-tokens/user-tokens.module' +import { UserTokensService } from '../src/modules/user-tokens/user-tokens.service' + +const canRunUserTokensE2E = Boolean(process.env.E2E) && Boolean(process.env.DB_URL) + +const describeWithUserTokens = describe.runIf(canRunUserTokensE2E) + +describeWithUserTokens('UserTokensService (e2e)', () => { + let moduleRef: TestingModule + let service: UserTokensService + let prisma: PrismaService + + const createdTokenIds: string[] = [] + const createdUserIds: string[] = [] + let ownerId: string + let otherUserId: string + + beforeAll(async () => { + moduleRef = await Test.createTestingModule({ + imports: [UserTokensModule], + }).compile() + + await moduleRef.init() + + service = moduleRef.get(UserTokensService) + prisma = moduleRef.get(PrismaService) + + ownerId = faker.string.uuid() + otherUserId = faker.string.uuid() + + await prisma.user.create({ + data: { + id: ownerId, + email: faker.internet.email().toLowerCase(), + firstName: faker.person.firstName(), + lastName: faker.person.lastName(), + type: 'human', + adminRoleIds: [], + }, + }) + createdUserIds.push(ownerId) + + await prisma.user.create({ + data: { + id: otherUserId, + email: faker.internet.email().toLowerCase(), + firstName: faker.person.firstName(), + lastName: faker.person.lastName(), + type: 'human', + adminRoleIds: [], + }, + }) + createdUserIds.push(otherUserId) + }) + + afterAll(async () => { + if (prisma) { + await prisma.personalAccessToken.deleteMany({ where: { id: { in: createdTokenIds } } }).catch(() => {}) + await prisma.user.deleteMany({ where: { id: { in: createdUserIds } } }).catch(() => {}) + } + + await moduleRef?.close() + vi.restoreAllMocks() + vi.unstubAllEnvs() + }) + + it('should create a personal access token with plaintext password', async () => { + const result = await service.create({ + name: `e2e-pat-${faker.string.uuid()}`, + expirationDate: new Date(Date.now() + 86400000), + }, ownerId) + + expect(result.id).toBeTruthy() + expect(result.password).toBeTruthy() + expect(result.password.length).toBe(48) + expect(result.name).toMatch(/^e2e-pat-/) + expect(result.expirationDate).toBeTruthy() + + createdTokenIds.push(result.id) + }) + + it('should list only tokens for the requesting user', async () => { + const tokenName = `e2e-pat-list-${faker.string.uuid()}` + const created = await service.create({ + name: tokenName, + expirationDate: new Date(Date.now() + 86400000), + }, ownerId) + createdTokenIds.push(created.id) + + const otherTokenName = `e2e-pat-other-${faker.string.uuid()}` + const otherToken = await service.create({ + name: otherTokenName, + expirationDate: new Date(Date.now() + 86400000), + }, otherUserId) + createdTokenIds.push(otherToken.id) + + const userTokens = await service.list(ownerId) + expect(userTokens.some(t => t.id === created.id)).toBe(true) + expect(userTokens.some(t => t.id === otherToken.id)).toBe(false) + }) + + it('should hard-delete token and remove it from list', async () => { + const created = await service.create({ + name: `e2e-pat-delete-${faker.string.uuid()}`, + expirationDate: new Date(Date.now() + 86400000), + }, ownerId) + createdTokenIds.push(created.id) + + await service.delete(created.id, ownerId) + + const userTokens = await service.list(ownerId) + expect(userTokens.some(t => t.id === created.id)).toBe(false) + + const stored = await prisma.personalAccessToken.findUnique({ where: { id: created.id } }) + expect(stored).toBeNull() + }) + + it('should not delete another user\'s token', async () => { + const otherToken = await service.create({ + name: `e2e-pat-foreign-${faker.string.uuid()}`, + expirationDate: new Date(Date.now() + 86400000), + }, otherUserId) + createdTokenIds.push(otherToken.id) + + await service.delete(otherToken.id, ownerId) + + const stored = await prisma.personalAccessToken.findUnique({ where: { id: otherToken.id } }) + expect(stored).not.toBeNull() + }) + + it('should reject creation with expiration date in the past', async () => { + const yesterday = new Date(Date.now() - 86400000) + await expect(service.create({ + name: `e2e-pat-expired-${faker.string.uuid()}`, + expirationDate: yesterday, + }, ownerId)).rejects.toThrow('Date d\'expiration trop courte') + }) + + it('should persist SHA256 hash of the password in DB', async () => { + const created = await service.create({ + name: `e2e-pat-hash-${faker.string.uuid()}`, + expirationDate: new Date(Date.now() + 86400000), + }, ownerId) + createdTokenIds.push(created.id) + + const stored = await prisma.personalAccessToken.findUniqueOrThrow({ + where: { id: created.id }, + select: { hash: true }, + }) + + const expectedHash = createHash('sha256').update(created.password).digest('hex') + expect(stored.hash).toBe(expectedHash) + }) + + it('should omit hash from API responses', async () => { + const created = await service.create({ + name: `e2e-pat-omit-${faker.string.uuid()}`, + expirationDate: new Date(Date.now() + 86400000), + }, ownerId) + createdTokenIds.push(created.id) + + expect(created).not.toHaveProperty('hash') + + const listed = await service.list(ownerId) + const found = listed.find(t => t.id === created.id) + expect(found).toBeTruthy() + expect(found).not.toHaveProperty('hash') + }) +}) From f3792e29bdbf8caecab1dcfd2a73a44b4ac6d771 Mon Sep 17 00:00:00 2001 From: Shikanime Deva Date: Tue, 28 Jul 2026 14:16:40 +0200 Subject: [PATCH 2/5] fix(ci): resolve server-nestjs build and SonarQube coverage gate - Export CoerceBooleanSchema from @cpn-console/shared schemas index so server-nestjs can import it (TS2305 broke the Docker build). - Add apps/server-nestjs to sonar.javascript.lcov.reportPaths; the PR's new code was uncovered and failed the new-code coverage quality gate. Co-Authored-By: Shikanime Deva --- .github/workflows/job-tests-unit.yml | 2 +- packages/shared/src/schemas/index.ts | 1 + 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/.github/workflows/job-tests-unit.yml b/.github/workflows/job-tests-unit.yml index 993ff302cf..cd006ca7d2 100644 --- a/.github/workflows/job-tests-unit.yml +++ b/.github/workflows/job-tests-unit.yml @@ -160,7 +160,7 @@ jobs: -Dsonar.projectKey=${{ secrets.SONAR_PROJECT_KEY }} -Dsonar.sources=apps,packages -Dsonar.javascript.node.maxspace=4096 - -Dsonar.javascript.lcov.reportPaths=coverage/apps/server/coverage/lcov.info,coverage/apps/client/coverage/lcov.info,coverage/packages/shared/coverage/lcov.info + -Dsonar.javascript.lcov.reportPaths=coverage/apps/server/coverage/lcov.info,coverage/apps/client/coverage/lcov.info,coverage/apps/server-nestjs/coverage/lcov.info,coverage/packages/shared/coverage/lcov.info -Dsonar.coverage.exclusions=**/*.spec.js,**/*.spec.ts,**/*.vue,**/assets/**,**/packages/test-utils/**,apps/server/src/plugins/** -Dsonar.cpd.exclusions=**/*.spec.js,**/*.spec.ts -Dsonar.scm.provider=git diff --git a/packages/shared/src/schemas/index.ts b/packages/shared/src/schemas/index.ts index 236c4124b2..6b931189b4 100644 --- a/packages/shared/src/schemas/index.ts +++ b/packages/shared/src/schemas/index.ts @@ -1,5 +1,6 @@ export * from './cluster.js' export * from './config.js' +export * from './_utils.js' export * from './deployment.js' export * from './environment.js' export * from './log.js' From a8de082fa883eeee579dc0471f247c7e32c566f3 Mon Sep 17 00:00:00 2001 From: Shikanime Deva Date: Tue, 28 Jul 2026 14:19:06 +0200 Subject: [PATCH 3/5] style(shared): sort schemas exports per perfectionist rule Move './_utils.js' before './config.js' to satisfy perfectionist/sort-exports in the shared lint gate. Co-Authored-By: Shikanime Deva --- packages/shared/src/schemas/index.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/packages/shared/src/schemas/index.ts b/packages/shared/src/schemas/index.ts index 6b931189b4..c8058b1da4 100644 --- a/packages/shared/src/schemas/index.ts +++ b/packages/shared/src/schemas/index.ts @@ -1,6 +1,6 @@ +export * from './_utils.js' export * from './cluster.js' export * from './config.js' -export * from './_utils.js' export * from './deployment.js' export * from './environment.js' export * from './log.js' From 0c0b960843708eeaeecfc9d3589092086cdccd5d Mon Sep 17 00:00:00 2001 From: Shikanime Deva Date: Tue, 28 Jul 2026 14:20:44 +0200 Subject: [PATCH 4/5] test(user-tokens): add query-utils unit specs for coverage gate Cover the newly migrated admin-token and user-tokens data-access functions (list/create/revoke, bot-user creation) with mockDeep-based unit tests. Lifts new-code coverage for the SonarQube quality gate alongside the build/runtime fixes already on this branch. --- .../admin-token-queries.utils.spec.ts | 90 +++++++++++++++++++ .../user-tokens-queries.utils.spec.ts | 46 ++++++++++ 2 files changed, 136 insertions(+) create mode 100644 apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.spec.ts create mode 100644 apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.spec.ts diff --git a/apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.spec.ts b/apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.spec.ts new file mode 100644 index 0000000000..39707f3954 --- /dev/null +++ b/apps/server-nestjs/src/modules/admin-token/admin-token-queries.utils.spec.ts @@ -0,0 +1,90 @@ +import type { Prisma } from '@prisma/client' +import type { DeepMockProxy } from 'vitest-mock-extended' +import { faker } from '@faker-js/faker' +import { beforeEach, describe, expect, it } from 'vitest' +import { mockDeep } from 'vitest-mock-extended' +import { + adminTokenSelect, + createAdminToken, + createBotUser, + listAdminTokens, + revokeAdminToken, +} from './admin-token-queries.utils' + +describe('admin-token-queries.utils', () => { + let tx: DeepMockProxy + + beforeEach(() => { + tx = mockDeep() + }) + + describe('listAdminTokens', () => { + it('filters to active tokens by default', async () => { + tx.adminToken.findMany.mockResolvedValue([]) + + await listAdminTokens(tx, false) + + expect(tx.adminToken.findMany).toHaveBeenCalledWith( + expect.objectContaining({ where: { status: 'active' }, select: adminTokenSelect }), + ) + }) + + it('includes revoked tokens when withRevoked is true', async () => { + tx.adminToken.findMany.mockResolvedValue([]) + + await listAdminTokens(tx, true) + + expect(tx.adminToken.findMany).toHaveBeenCalledWith( + expect.objectContaining({ where: { status: { in: ['active', 'revoked'] } }, select: adminTokenSelect }), + ) + }) + }) + + describe('createBotUser', () => { + it('creates a bot user with a derived email', async () => { + const botUserId = faker.string.uuid() + const name = faker.person.fullName() + + await createBotUser(tx, { botUserId, name }) + + expect(tx.user.create).toHaveBeenCalledWith({ + data: { + firstName: 'Bot Admin', + lastName: name, + type: 'bot', + id: botUserId, + email: `${botUserId}@bot.io`, + }, + }) + }) + }) + + describe('createAdminToken', () => { + it('creates an admin token with the provided fields', async () => { + const data = { + name: faker.word.noun(), + permissions: 4n, + expirationDate: null, + hash: faker.string.alphanumeric(64), + userId: faker.string.uuid(), + } + + await createAdminToken(tx, data) + + expect(tx.adminToken.create).toHaveBeenCalledWith({ data, select: adminTokenSelect }) + }) + }) + + describe('revokeAdminToken', () => { + it('marks the token revoked with a fresh expiration date', async () => { + const id = faker.string.uuid() + + await revokeAdminToken(tx, id) + + const call = tx.adminToken.updateMany.mock.calls[0]?.[0] + expect(call?.where).toEqual({ id }) + expect(call?.data.status).toBe('revoked') + expect(call?.data.expirationDate).toBeInstanceOf(Date) + }) + }) +}) diff --git a/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.spec.ts b/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.spec.ts new file mode 100644 index 0000000000..44511f6f95 --- /dev/null +++ b/apps/server-nestjs/src/modules/user-tokens/user-tokens-queries.utils.spec.ts @@ -0,0 +1,46 @@ +import type { Prisma } from '@prisma/client' +import type { DeepMockProxy } from 'vitest-mock-extended' +import { faker } from '@faker-js/faker' +import { beforeEach, describe, expect, it } from 'vitest' +import { mockDeep } from 'vitest-mock-extended' +import { + createUserToken, + listUserTokens, + userTokenSelect, +} from './user-tokens-queries.utils' + +describe('user-tokens-queries.utils', () => { + let tx: DeepMockProxy + + beforeEach(() => { + tx = mockDeep() + }) + + describe('listUserTokens', () => { + it('scopes by userId and uses the shared select', async () => { + const userId = faker.string.uuid() + tx.personalAccessToken.findMany.mockResolvedValue([]) + + await listUserTokens(tx, userId) + + expect(tx.personalAccessToken.findMany).toHaveBeenCalledWith( + expect.objectContaining({ where: { userId }, select: userTokenSelect }), + ) + }) + }) + + describe('createUserToken', () => { + it('creates a personal access token with the provided fields', async () => { + const data = { + name: faker.word.noun(), + expirationDate: faker.date.future(), + hash: faker.string.alphanumeric(64), + userId: faker.string.uuid(), + } + + await createUserToken(tx, data) + + expect(tx.personalAccessToken.create).toHaveBeenCalledWith({ data, select: userTokenSelect }) + }) + }) +}) From 26c681e4af7b51c484f2bd33c08c11dd5dcab838 Mon Sep 17 00:00:00 2001 From: Shikanime Deva Date: Tue, 28 Jul 2026 14:34:12 +0200 Subject: [PATCH 5/5] fix(server-nestjs): emit lcov coverage so SonarQube gate reads new code The vitest coverage reporter was set to text/json/html but no lcov, so `vitest --coverage` never wrote coverage/lcov.info. Sonar's reportPath for server-nestjs then resolved to nothing and the PR's new code reported 0% coverage, failing the quality gate. Match the sibling apps' ['text','lcov']. Signed-off-by: William Phetsinorath Co-Authored-By: Shikanime Deva --- apps/server-nestjs/vitest.config.ts | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/apps/server-nestjs/vitest.config.ts b/apps/server-nestjs/vitest.config.ts index b0337f6d0b..2662f80314 100644 --- a/apps/server-nestjs/vitest.config.ts +++ b/apps/server-nestjs/vitest.config.ts @@ -16,7 +16,7 @@ export default defineConfig({ include: ['src/**/*.spec.ts', 'test/**/*.e2e-spec.ts'], coverage: { provider: 'v8', - reporter: ['text', 'json', 'html'], + reporter: ['text', 'lcov'], }, }, })