Merge pull request #432 from shamoo53/Authentication-Authorization-JWT-refresh-tokens-and-RBAC

Authentication & Authorization: JWT, refresh tokens, and RBAC

Author: DevMuhdishaq

.env.example

@@ -46,8 +46,9 @@ QUEUE_REMOVE_ON_FAIL=false
 
 # Authentication Configuration
 JWT_SECRET=your-super-secret-jwt-key-change-this-in-production
-JWT_EXPIRES_IN=3600
+JWT_EXPIRES_IN=900
 JWT_REFRESH_SECRET=your-refresh-secret-key-change-this-in-production
+JWT_REFRESH_EXPIRES_IN=604800
 
 # Email (SMTP) Configuration - Nodemailer
 SMTP_HOST=smtp.example.com

src/auth/auth.controller.ts

@@ -30,26 +30,29 @@ import {
 } from './dto/password-reset.dto';
 import { Enable2FADto, TwoFADto, Verify2FASetupDto } from './dto/2fa.dto';
 import { JwtAuthGuard } from './guards/jwt-auth.guard';
+import { RolesGuard } from './guards/roles.guard';
 import type { JwtPayload } from './guards/jwt-auth.guard';
 import { CurrentUser } from './decorators/current-user.decorator';
 import { Public } from './decorators/public.decorator';
 import { ApiAuthErrorResponses } from '../common/decorators/swagger-error-responses.decorator';
+import { Roles } from '../identity/roles/decorators/roles.decorator';
+import { UserRole } from '../identity/roles/enums/user-role.enum';
 
-@ApiTags('identity/auth')
-@UseGuards(JwtAuthGuard)
-@Controller('identity/auth')
+@ApiTags('auth')
+@UseGuards(JwtAuthGuard, RolesGuard)
+@Controller('auth')
 export class AuthController {
   constructor(private readonly authService: AuthService) {}
 
   // ─── Registration & Activation ─────────────────────────────────────────────
 
   @Public()
-  @Post('register')
+  @Post('signup')
   @HttpCode(HttpStatus.CREATED)
   @ApiOperation({ summary: 'Register a new user account' })
   @ApiResponse({ status: 201, description: 'Registration successful' })
   @ApiAuthErrorResponses()
-  register(@Body() dto: RegisterDto, @Req() req: Request) {
+  signup(@Body() dto: RegisterDto, @Req() req: Request) {
     const correlationId =
       (req.headers['x-correlation-id'] as string) ||
       (req.headers['x-request-id'] as string);
@@ -104,13 +107,13 @@ export class AuthController {
   // ─── Token Refresh ─────────────────────────────────────────────────────────
 
   @Public()
-  @Post('token/refresh')
+  @Post('refresh')
   @HttpCode(HttpStatus.OK)
   @ApiOperation({
     summary: 'Rotate refresh token and obtain new access + refresh tokens',
   })
   @ApiResponse({ status: 200, description: 'Tokens refreshed' })
-  refreshToken(@Body() dto: RefreshTokenDto) {
+  refresh(@Body() dto: RefreshTokenDto) {
     return this.authService.refreshTokens(dto);
   }
 
@@ -210,4 +213,41 @@ export class AuthController {
   disable2FA(@CurrentUser() user: JwtPayload, @Body() dto: TwoFADto) {
     return this.authService.disable2FA(user.sub, dto);
   }
+
+  // ─── Admin Endpoints ───────────────────────────────────────────────────────
+
+  @Get('admin/users')
+  @Roles(UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @ApiBearerAuth()
+  @ApiOperation({ summary: 'List all users (admin only)' })
+  @ApiResponse({ status: 200, description: 'List of all users' })
+  listAllUsers(@CurrentUser() user: JwtPayload) {
+    return this.authService.listAllUsers();
+  }
+
+  @Post('admin/users/:userId/roles')
+  @Roles(UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @ApiBearerAuth()
+  @ApiOperation({ summary: 'Assign roles to a user (admin only)' })
+  @ApiResponse({ status: 200, description: 'Roles assigned successfully' })
+  assignUserRole(
+    @CurrentUser() user: JwtPayload,
+    @Param('userId') userId: string,
+    @Body() body: { roles: UserRole[] },
+  ) {
+    return this.authService.assignUserRoles(userId, body.roles);
+  }
+
+  @Delete('admin/users/:userId/roles')
+  @Roles(UserRole.ADMIN, UserRole.SUPER_ADMIN)
+  @ApiBearerAuth()
+  @ApiOperation({ summary: 'Revoke roles from a user (admin only)' })
+  @ApiResponse({ status: 200, description: 'Roles revoked successfully' })
+  revokeUserRole(
+    @CurrentUser() user: JwtPayload,
+    @Param('userId') userId: string,
+    @Body() body: { roles: UserRole[] },
+  ) {
+    return this.authService.revokeUserRoles(userId, body.roles);
+  }
 }

src/auth/auth.module.ts

@@ -11,6 +11,7 @@ import { Auth } from './entities/auth.entity';
 import { Session } from './entities/session.entity';
 import { User } from '../user/entities/user.entity';
 import { JwtAuthGuard } from './guards/jwt-auth.guard';
+import { RolesGuard } from './guards/roles.guard';
 import { AuthAuditListener } from './listeners/auth-audit.listener';
 import { AuditLogModule } from '../audit-log/audit-log.module';
 
@@ -23,14 +24,20 @@ import { AuditLogModule } from '../audit-log/audit-log.module';
       useFactory: (config: ConfigService) => ({
         secret: config.get<string>('JWT_SECRET'),
         signOptions: {
-          expiresIn: config.get<number>('JWT_EXPIRES_IN', 3600),
+          expiresIn: config.get<number>('JWT_EXPIRES_IN', 900),
         },
       }),
     }),
     AuditLogModule,
   ],
   controllers: [AuthController, MFAController],
-  providers: [AuthService, MFAService, JwtAuthGuard, AuthAuditListener],
-  exports: [AuthService, MFAService, JwtAuthGuard, JwtModule],
+  providers: [
+    AuthService,
+    MFAService,
+    JwtAuthGuard,
+    RolesGuard,
+    AuthAuditListener,
+  ],
+  exports: [AuthService, MFAService, JwtAuthGuard, RolesGuard, JwtModule],
 })
 export class AuthModule {}

src/auth/auth.service.ts

@@ -122,8 +122,6 @@ export class AuthService {
       message:
         'Registration successful. Please check your email to activate your account.',
       userId: user.id,
-      // NOTE: In production, remove activationToken from response and send via email only
-      activationToken,
     };
   }
 
@@ -418,8 +416,6 @@ export class AuthService {
     return {
       message:
         'If an account with that email exists, a reset link has been sent.',
-      // NOTE: In production remove this and send via email only
-      resetToken: token,
     };
   }
 
@@ -743,4 +739,74 @@ export class AuthService {
       createdAt: user.createdAt,
     };
   }
+
+  // ─── Admin Functions ─────────────────────────────────────────────────────────
+
+  async listAllUsers() {
+    const users = await this.userRepo.find({
+      select: [
+        'id',
+        'username',
+        'email',
+        'firstName',
+        'lastName',
+        'role',
+        'roles',
+        'status',
+        'createdAt',
+      ],
+      order: { createdAt: 'DESC' },
+    });
+
+    return users.map((user) => this.sanitizeUser(user));
+  }
+
+  async assignUserRoles(userId: string, roles: UserRole[]) {
+    const user = await this.userRepo.findOne({ where: { id: userId } });
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    // Merge new roles with existing roles
+    const existingRoles = user.roles || [];
+    const updatedRoles = Array.from(new Set([...existingRoles, ...roles]));
+
+    user.roles = updatedRoles;
+    user.role = updatedRoles[0] || UserRole.USER;
+    await this.userRepo.save(user);
+
+    this.logger.log(`Roles assigned to user ${userId}: ${roles.join(', ')}`);
+
+    return {
+      message: 'Roles assigned successfully',
+      user: this.sanitizeUser(user),
+    };
+  }
+
+  async revokeUserRoles(userId: string, roles: UserRole[]) {
+    const user = await this.userRepo.findOne({ where: { id: userId } });
+    if (!user) {
+      throw new NotFoundException('User not found');
+    }
+
+    // Remove specified roles from existing roles
+    const existingRoles = user.roles || [];
+    const updatedRoles = existingRoles.filter((role) => !roles.includes(role));
+
+    // Ensure user always has at least USER role
+    if (updatedRoles.length === 0) {
+      updatedRoles.push(UserRole.USER);
+    }
+
+    user.roles = updatedRoles;
+    user.role = updatedRoles[0] || UserRole.USER;
+    await this.userRepo.save(user);
+
+    this.logger.log(`Roles revoked from user ${userId}: ${roles.join(', ')}`);
+
+    return {
+      message: 'Roles revoked successfully',
+      user: this.sanitizeUser(user),
+    };
+  }
 }

src/auth/guards/roles.guard.ts

@@ -0,0 +1,63 @@
+import {
+  CanActivate,
+  ExecutionContext,
+  ForbiddenException,
+  Injectable,
+} from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import { UserRole } from '../../identity/roles/enums/user-role.enum';
+import { ROLES_METADATA_KEY } from '../../identity/roles/decorators/roles.decorator';
+import { JwtPayload } from './jwt-auth.guard';
+
+/**
+ * Roles Guard - enforces role-based access control
+ * 
+ * Checks if the authenticated user has the required roles
+ * to access a protected endpoint
+ */
+@Injectable()
+export class RolesGuard implements CanActivate {
+  constructor(private readonly reflector: Reflector) {}
+
+  canActivate(context: ExecutionContext): boolean {
+    const requiredRoles = this.reflector.getAllAndOverride<UserRole[]>(
+      ROLES_METADATA_KEY,
+      [context.getHandler(), context.getClass()],
+    );
+
+    // If no roles are required, allow access
+    if (!requiredRoles || requiredRoles.length === 0) {
+      return true;
+    }
+
+    const request = context.switchToHttp().getRequest();
+    const user: JwtPayload = request.user;
+
+    if (!user) {
+      throw new ForbiddenException('Authentication required');
+    }
+
+    const userRoles: UserRole[] = user.roles as UserRole[] || [user.role as UserRole];
+
+    // SUPER_ADMIN and ADMIN bypass all role checks
+    if (
+      userRoles.includes(UserRole.SUPER_ADMIN) ||
+      userRoles.includes(UserRole.ADMIN)
+    ) {
+      return true;
+    }
+
+    // Check if user has at least one of the required roles
+    const hasRole = requiredRoles.some((requiredRole) =>
+      userRoles.includes(requiredRole),
+    );
+
+    if (!hasRole) {
+      throw new ForbiddenException(
+        `Access denied. Required roles: [${requiredRoles.join(', ')}]`,
+      );
+    }
+
+    return true;
+  }
+}