인증·인가와 서버 실행

npm install --save-exact @nestjs/[email protected] @nestjs/[email protected] [email protected] [email protected] [email protected] [email protected]
npm install --save-dev --save-exact @types/[email protected] @types/[email protected] @types/[email protected]

node -e "console.log(require('node:crypto').randomBytes(32).toString('base64url'))"

export interface AuthenticatedUser {
  id: number;
  email: string;
  name: string;
  isAdmin: boolean;
}

import { Injectable } from '@nestjs/common';
import { UserService } from '../user/user.service';
import { JwtService } from '@nestjs/jwt';
import * as bcrypt from 'bcryptjs';
import { AuthenticatedUser } from './authenticated-user';

@Injectable()
export class AuthService {
  constructor(
    private userService: UserService,
    private jwtService: JwtService, // JwtService 주입
  ) {}

  async validateUser(email: string, pass: string): Promise<AuthenticatedUser | null> {
    const user = await this.userService.findOneByEmail(email);
    if (user && (await bcrypt.compare(pass, user.password))) {
      return {
        id: user.id,
        email: user.email,
        name: user.name,
        isAdmin: user.isAdmin,
      };
    }
    return null;
  }

  async login(user: AuthenticatedUser) {
    const payload = { sub: user.id, email: user.email };
    return {
      accessToken: this.jwtService.sign(payload),
    };
  }
}

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { Strategy } from 'passport-local';
import { AuthService } from './auth.service';

@Injectable()
export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private readonly authService: AuthService) {
    super({ usernameField: 'email', passwordField: 'password' });
  }

  async validate(email: string, password: string) {
    const user = await this.authService.validateUser(email, password);
    if (!user) {
      throw new UnauthorizedException();
    }
    return user;
  }
}

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { Strategy, ExtractJwt } from 'passport-jwt';
import { ConfigService } from '@nestjs/config'; // ConfigService 임포트
import { UserService } from '../user/user.service';
import { AuthenticatedUser } from './authenticated-user';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(
    private configService: ConfigService,
    private userService: UserService,
  ) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(), // Bearer 토큰에서 JWT 추출
      ignoreExpiration: false, // 만료된 토큰 무시 안 함
      secretOrKey: configService.getOrThrow<string>('JWT_SECRET'), // 키가 없으면 시작 거절
    });
  }

  async validate(payload: unknown): Promise<AuthenticatedUser> {
    if (
      typeof payload !== 'object' || payload === null ||
      !('sub' in payload) || typeof payload.sub !== 'number' ||
      !Number.isSafeInteger(payload.sub) || payload.sub <= 0 ||
      !('email' in payload) || typeof payload.email !== 'string'
    ) {
      throw new UnauthorizedException();
    }

    const user = await this.userService.findOneByIdOrNull(payload.sub);
    if (!user || user.email !== payload.email) {
      throw new UnauthorizedException();
    }

    return {
      id: user.id,
      email: user.email,
      name: user.name,
      isAdmin: user.isAdmin,
    };
  }
}

import { Module } from '@nestjs/common';
import { PassportModule } from '@nestjs/passport';
import { JwtModule } from '@nestjs/jwt';
import { ConfigModule, ConfigService } from '@nestjs/config';
import { AuthService } from './auth.service';
import { UserModule } from '../user/user.module';
import { LocalStrategy } from './local.strategy'; // 로컬 전략 (사용자 이름/비밀번호)
import { JwtStrategy } from './jwt.strategy';
import { AuthController } from './auth.controller';
import { LocalAuthGuard } from './local-auth.guard';
import { JwtAuthGuard } from './jwt-auth.guard';

@Module({
  imports: [
    UserModule, // UserService를 사용하기 위해 UserModule 임포트
    PassportModule,
    JwtModule.registerAsync({ // 비동기로 JWT 설정 (ConfigService 주입)
      imports: [ConfigModule],
      useFactory: async (configService: ConfigService) => ({
        secret: configService.getOrThrow<string>('JWT_SECRET'),
        signOptions: { expiresIn: '60m' }, // 토큰 만료 시간
      }),
      inject: [ConfigService],
    }),
  ],
  controllers: [AuthController],
  providers: [AuthService, LocalStrategy, JwtStrategy, LocalAuthGuard, JwtAuthGuard],
  exports: [AuthService], // AuthService를 다른 모듈에서 사용 가능하도록 내보내기
})
export class AuthModule {}

import { Module } from '@nestjs/common';
import { ConfigModule } from '@nestjs/config';
import { TypeOrmModule } from '@nestjs/typeorm';
import { AppController } from './app.controller';
import { AppService } from './app.service';
import { UserModule } from './user/user.module';
import { AuthModule } from './auth/auth.module';

@Module({
  imports: [
    ConfigModule.forRoot({
      isGlobal: true, // 어디서든 ConfigService를 주입받아 사용 가능
      envFilePath: '.env', // .env 파일 경로 지정
    }),
    TypeOrmModule.forRoot({
      type: 'postgres',
      host: process.env.DATABASE_HOST,
      port: parseInt(process.env.DATABASE_PORT || '5432', 10),
      username: process.env.DATABASE_USER,
      password: process.env.DATABASE_PASSWORD,
      database: process.env.DATABASE_NAME,
      entities: [__dirname + '/**/*.entity{.ts,.js}'], // 모든 엔티티 파일을 자동으로 찾음
      synchronize: process.env.NODE_ENV === 'development', // 개발 환경에서만 동기화
      logging: process.env.NODE_ENV === 'development', // 개발 환경에서만 로깅
    }),
    UserModule,
    AuthModule,
  ],
  controllers: [AppController],
  providers: [AppService],
})
export class AppModule {}

import { Controller, Get, Post, Request, UseGuards, Body, HttpCode, HttpStatus } from '@nestjs/common';
import { AuthService } from './auth.service';
import { LocalAuthGuard } from './local-auth.guard';
import { JwtAuthGuard } from './jwt-auth.guard';
import { CreateUserDto } from '../user/dto/create-user.dto';
import { UserService } from '../user/user.service';
import { AuthenticatedUser } from './authenticated-user';
import { PublicUserDto, toPublicUser } from '../user/dto/public-user.dto';

@Controller('auth')
export class AuthController {
  constructor(
    private authService: AuthService,
    private userService: UserService, // 회원가입을 위해 UserService 사용
  ) {}

  @Post('register')
  @HttpCode(HttpStatus.CREATED)
  async register(@Body() createUserDto: CreateUserDto): Promise<PublicUserDto> {
    return toPublicUser(await this.userService.create(createUserDto));
  }

  @UseGuards(LocalAuthGuard) // LocalAuthGuard를 사용하여 로컬 전략 실행
  @Post('login')
  @HttpCode(HttpStatus.OK) // 200 OK 응답
  async login(@Request() req: { user: AuthenticatedUser }) {
    // LocalAuthGuard가 req.user에 사용자 정보를 저장합니다.
    return this.authService.login(req.user);
  }

  @UseGuards(JwtAuthGuard)
  @Get('profile')
  profile(@Request() req: { user: AuthenticatedUser }): PublicUserDto {
    return toPublicUser(req.user);
  }
}

import { Injectable } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Injectable()
export class LocalAuthGuard extends AuthGuard('local') {} // 'local' 전략 사용

import { Injectable } from '@nestjs/common';
import { AuthGuard } from '@nestjs/passport';

@Injectable()
export class JwtAuthGuard extends AuthGuard('jwt') {} // 'jwt' 전략 사용

import { SetMetadata } from '@nestjs/common';

export const ROLES_KEY = 'roles';
export const Roles = (...roles: Array<'admin'>) => SetMetadata(ROLES_KEY, roles);

import { Injectable, CanActivate, ExecutionContext } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import { ROLES_KEY } from './roles.decorator';
import { AuthenticatedUser } from './authenticated-user';

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const requiredRoles = this.reflector.getAllAndOverride<Array<'admin'>>(ROLES_KEY, [
      context.getHandler(), // 메서드 레벨 데코레이터
      context.getClass(),   // 클래스 레벨 데코레이터
    ]);
    if (!requiredRoles) {
      return true; // 역할 제한이 없으면 접근 허용
    }

    const { user } = context.switchToHttp().getRequest<{ user?: AuthenticatedUser }>();
    return requiredRoles.some((role) => role === 'admin' && user?.isAdmin === true);
  }
}