인증·인가와 서버 실행

npm install --save-exact @nestjs/[email protected] @nestjs/[email protected] [email protected] [email protected] [email protected] [email protected]
npm install --save-dev --save-exact @types/[email protected] @types/[email protected] @types/[email protected]

node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"

export interface AuthenticatedUser {
  id: number;
  email: string;
  name: string;
  isAdmin: boolean;
}

import { Injectable } from "@nestjs/common";
import { JwtService } from "@nestjs/jwt";
import * as bcrypt from "bcryptjs";
import { UserService } from "../user/user.service";
import { AuthenticatedUser } from "./authenticated-user";

@Injectable()
export class AuthService {
  constructor(
    private readonly userService: UserService,
    private readonly jwtService: JwtService,
  ) {}

  async validateUser(email: string, password: string): Promise<AuthenticatedUser | null> {
    const user = await this.userService.findOneByEmail(email);
    if (user && (await bcrypt.compare(password, user.password))) {
      return { id: user.id, email: user.email, name: user.name, isAdmin: user.isAdmin };
    }
    return null;
  }

  login(user: AuthenticatedUser): { accessToken: string } {
    return { accessToken: this.jwtService.sign({ sub: String(user.id), email: user.email }) };
  }
}

import { Injectable, UnauthorizedException } from "@nestjs/common";
import { PassportStrategy } from "@nestjs/passport";
import { Strategy } from "passport-local";
import { AuthService } from "./auth.service";
import { AuthenticatedUser } from "./authenticated-user";

@Injectable()
export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private readonly authService: AuthService) {
    super({ usernameField: "email", passwordField: "password" });
  }

  async validate(email: string, password: string): Promise<AuthenticatedUser> {
    const user = await this.authService.validateUser(email, password);
    if (!user) {
      throw new UnauthorizedException();
    }
    return user;
  }
}

import { Injectable, UnauthorizedException } from "@nestjs/common";
import { ConfigService } from "@nestjs/config";
import { PassportStrategy } from "@nestjs/passport";
import { ExtractJwt, Strategy } from "passport-jwt";
import { UserService } from "../user/user.service";
import { AuthenticatedUser } from "./authenticated-user";

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(
    configService: ConfigService,
    private readonly userService: UserService,
  ) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: configService.getOrThrow<string>("JWT_SECRET"),
    });
  }

  async validate(payload: unknown): Promise<AuthenticatedUser> {
    if (
      typeof payload !== "object" || payload === null ||
      !("sub" in payload) || typeof payload.sub !== "string" || !/^[1-9][0-9]*$/.test(payload.sub) ||
      !Number.isSafeInteger(Number(payload.sub)) ||
      !("email" in payload) || typeof payload.email !== "string"
    ) {
      throw new UnauthorizedException();
    }

    const user = await this.userService.findOneByIdOrNull(Number(payload.sub));
    if (!user || user.email !== payload.email) {
      throw new UnauthorizedException();
    }
    return { id: user.id, email: user.email, name: user.name, isAdmin: user.isAdmin };
  }
}

import { Injectable } from "@nestjs/common";
import { AuthGuard } from "@nestjs/passport";

@Injectable()
export class LocalAuthGuard extends AuthGuard("local") {}

import { Injectable } from "@nestjs/common";
import { AuthGuard } from "@nestjs/passport";

@Injectable()
export class JwtAuthGuard extends AuthGuard("jwt") {}

import { Module } from "@nestjs/common";
import { ConfigService } from "@nestjs/config";
import { JwtModule } from "@nestjs/jwt";
import { PassportModule } from "@nestjs/passport";
import { UserModule } from "../user/user.module";
import { AuthController } from "./auth.controller";
import { AuthService } from "./auth.service";
import { JwtAuthGuard } from "./jwt-auth.guard";
import { JwtStrategy } from "./jwt.strategy";
import { LocalAuthGuard } from "./local-auth.guard";
import { LocalStrategy } from "./local.strategy";

@Module({
  imports: [
    UserModule,
    PassportModule,
    JwtModule.registerAsync({
      inject: [ConfigService],
      useFactory: (configService: ConfigService) => ({
        secret: configService.getOrThrow<string>("JWT_SECRET"),
        signOptions: { expiresIn: "60m" },
      }),
    }),
  ],
  controllers: [AuthController],
  providers: [AuthService, LocalStrategy, JwtStrategy, LocalAuthGuard, JwtAuthGuard],
})
export class AuthModule {}

import { Module } from "@nestjs/common";
import { ConfigModule } from "@nestjs/config";
import { TypeOrmModule } from "@nestjs/typeorm";
import { AuthModule } from "./auth/auth.module";
import { UserModule } from "./user/user.module";

@Module({
  imports: [
    ConfigModule.forRoot({ isGlobal: true, envFilePath: ".env" }),
    TypeOrmModule.forRoot({
      type: "postgres",
      host: process.env.DATABASE_HOST,
      port: Number.parseInt(process.env.DATABASE_PORT ?? "5432", 10),
      username: process.env.DATABASE_USER,
      password: process.env.DATABASE_PASSWORD,
      database: process.env.DATABASE_NAME,
      entities: [__dirname + "/**/*.entity{.ts,.js}"],
      synchronize: process.env.NODE_ENV === "development",
      logging: process.env.NODE_ENV === "development",
    }),
    UserModule,
    AuthModule,
  ],
})
export class AppModule {}

import { Body, Controller, Get, HttpCode, HttpStatus, Post, Request, UseGuards } from "@nestjs/common";
import { CreateUserDto } from "../user/dto/create-user.dto";
import { toPublicUser } from "../user/dto/public-user.dto";
import type { PublicUserDto } from "../user/dto/public-user.dto";
import { UserService } from "../user/user.service";
import { AuthService } from "./auth.service";
import { AuthenticatedUser } from "./authenticated-user";
import { JwtAuthGuard } from "./jwt-auth.guard";
import { LocalAuthGuard } from "./local-auth.guard";

@Controller("auth")
export class AuthController {
  constructor(
    private readonly authService: AuthService,
    private readonly userService: UserService,
  ) {}

  @Post("register")
  @HttpCode(HttpStatus.CREATED)
  async register(@Body() dto: CreateUserDto): Promise<PublicUserDto> {
    return toPublicUser(await this.userService.create(dto));
  }

  @UseGuards(LocalAuthGuard)
  @Post("login")
  @HttpCode(HttpStatus.OK)
  login(@Request() req: { user: AuthenticatedUser }): { accessToken: string } {
    return this.authService.login(req.user);
  }

  @UseGuards(JwtAuthGuard)
  @Get("profile")
  profile(@Request() req: { user: AuthenticatedUser }): PublicUserDto {
    return toPublicUser(req.user);
  }
}

import { SetMetadata } from "@nestjs/common";

export const ROLES_KEY = "roles";
export const Roles = (...roles: Array<"admin">) => SetMetadata(ROLES_KEY, roles);

import { Injectable } from "@nestjs/common";
import type { CanActivate, ExecutionContext } from "@nestjs/common";
import { Reflector } from "@nestjs/core";
import { AuthenticatedUser } from "./authenticated-user";
import { ROLES_KEY } from "./roles.decorator";

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<Array<"admin">>(ROLES_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);
    if (!requiredRoles) {
      return true;
    }
    const { user } = context.switchToHttp().getRequest<{ user?: AuthenticatedUser }>();
    return requiredRoles.some((role) => role === "admin" && user?.isAdmin === true);
  }
}

npm run start:dev

curl -i http://localhost:4100/auth/register -H "Content-Type: application/json" -d '{"email":"[email protected]","password":"local-practice-password","name":"학습자"}'
curl -i http://localhost:4100/auth/login -H "Content-Type: application/json" -d '{"email":"[email protected]","password":"local-practice-password"}'

curl -i http://localhost:4100/auth/profile -H "Authorization: Bearer <받은 accessToken>"