@tc-libs/authentication

Layer di autenticazione/autorizzazione per NestJS basato su JWT, permission token e OAuth opzionale Google/Apple.

Il package esporta:

• AuthModule
• AuthService
• decorator per protezione endpoint
• guard e strategy
• enum ENUM_AUTH_ACCESS_FOR

Prerequisito importante

AuthService dipende da PasswordService e TokenService di @tc-libs/helper. In pratica questo package va usato insieme a HelperModule.

Registrazione

AuthModule.register(
  {
    jwt: {
      defaultSecretKey: process.env.JWT_DEFAULT_SECRET!,
      defaultExpirationTime: 3600,
    },
    auth: {
      prefixAuthorization: 'Bearer',
      subject: 'access',
      audience: 'my-api',
      issuer: 'my-service',
      payloadEncryption: true,
      accessToken: {
        secretKey: process.env.ACCESS_TOKEN_SECRET!,
        expirationTime: 3600,
        notBeforeExpirationTime: 0,
        encryptKey: process.env.ACCESS_TOKEN_ENCRYPT_KEY!,
        encryptIv: process.env.ACCESS_TOKEN_ENCRYPT_IV!,
      },
      refreshToken: {
        secretKey: process.env.REFRESH_TOKEN_SECRET!,
        expirationTime: 86400,
        expirationTimeRememberMe: 2592000,
        notBeforeExpirationTime: 0,
        encryptKey: process.env.REFRESH_TOKEN_ENCRYPT_KEY!,
        encryptIv: process.env.REFRESH_TOKEN_ENCRYPT_IV!,
      },
      permissionToken: {
        headerName: 'x-permission-token',
        secretKey: process.env.PERMISSION_TOKEN_SECRET!,
        expirationTime: 900,
        notBeforeExpirationTime: 0,
        encryptKey: process.env.PERMISSION_TOKEN_ENCRYPT_KEY!,
        encryptIv: process.env.PERMISSION_TOKEN_ENCRYPT_IV!,
      },
    },
  },
  true,
);

Le strategy Google e Apple vengono registrate solo se la relativa configurazione e completa.

AuthService

Metodi principali:

• getAuthToken(payload, rememberMe)
• getRefreshToken(payload, refreshToken, rememberMe, loginDate)
• validateUser(password, hash)
• createPassword(password)
• getter per scadenze, issuer, audience, subject

Esempio login:

const token = await this.authService.getAuthToken(
  { _id: user._id.toString(), email: user.email, role: user.role },
  false,
);

Decorator utili

• AuthJwtAccessProtected()
• AuthJwtRefreshProtected()
• AuthJwtPublicAccessProtected()
• AuthJwtAdminAccessProtected()
• AuthPermissionProtected(group, ...permissions)
• CurrentUser()
• User()
• AuthJwtPayload()
• AuthJwtToken()

Esempio:

@Get('me')
@AuthJwtAccessProtected()
profile(@CurrentUser() user: any) {
  return user;
}

Access levels

Il package definisce:

• SUPER_ADMIN
• USER
• ADMIN
• EDITOR
• LOGISTIC

Questi valori vengono riusati da role, api-key e altri package.

Sviluppo

nx build authentication
nx test authentication