Authentication

import { Strategy } from 'passport-local';
import { PassportStrategy } from '@nestjs/passport';
import { Injectable, UnauthorizedException } from '@nestjs/common';
import { AuthService } from './auth.service';

@Injectable()
export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private authService: AuthService) {
    super({ usernameField: 'email' });
  }

  async validate(email: string, password: string): Promise<any> {
    const user = await this.authService.validateUser({ email, password });
    if (!user) {
      throw new UnauthorizedException();
    }
    return user;
  }
}

async validateUser(body: LoginDto): Promise<any> {
  const user = await this.prisma.usuario.findFirst({
    where: {
      email: body.email,
    },
  });

  if (!user) {
    throw new UnauthorizedException('Senha ou e-mail inválido.');
  }

  const isPasswordValid = await this.hashingService.compare(
    body.password,
    user.senhaHash,
  );
  
  if (!isPasswordValid) {
    throw new UnauthorizedException('Senha ou e-mail inválido.');
  }

  // Retorna o usuário sem a senha
  const { senhaHash, ...result } = user;
  return result;
}

import * as bcrypt from 'bcrypt';

export class BcryptService extends HashingServiceProtocol {
  async hash(password: string): Promise<string> {
    const salt = await bcrypt.genSalt();
    return bcrypt.hash(password, salt);
  }

  async compare(password: string, hash: string): Promise<boolean> {
    return bcrypt.compare(password, hash);
  }
}

async login(user: UserDto): Promise<any> {
  const token = await this.jwtService.signAsync(
    {
      sub: user.id_User,
      email: user.email,
      access: user.roleId,
    },
    {
      secret: this.jwtConfiguration.secret,
      expiresIn: this.jwtConfiguration.jwtTtl,
      audience: this.jwtConfiguration.audience,
      issuer: this.jwtConfiguration.issuer,
    },
  );

  return {
    id: user.id_User,
    name: user.nome,
    email: user.email,
    roleId: user.roleId,
    token: token,
  };
}

import { Controller, Post, UseGuards, Request } from '@nestjs/common';
import { AuthService } from './auth.service';
import { LocalAuthGuard } from './guards/local-auth.guard';

@Controller('auth')
export class AuthController {
  constructor(private authService: AuthService) {}

  @UseGuards(LocalAuthGuard)
  @Post('login')
  async loginWithPassport(@Request() req: any): Promise<any> {
    // Depois de verificado, geramos um token para o usuário
    return this.authService.login(req.user);
  }
}

import { ExtractJwt, Strategy } from 'passport-jwt';
import { PassportStrategy } from '@nestjs/passport';
import { Injectable } from '@nestjs/common';

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(private readonly authService: AuthService) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      ignoreExpiration: false,
      secretOrKey: jwtConstants.secret as string,
    });
  }

  async validate(payload) {
    return payload;
  }
}

import { Controller, Get, UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard';

@Controller('users')
@UseGuards(JwtAuthGuard) // Protects all routes in this controller
export class UsersController {
  @Get()
  findAll(@Req() req: any) {
    // req.user contains the decoded JWT payload
    return this.usersService.findAll(req.user);
  }
}

import { signIn } from "next-auth/react"
import { useState } from "react"
import { useRouter } from "next/navigation"

export function LoginForm() {
  const [email, setEmail] = useState("")
  const [password, setPassword] = useState("")
  const [isLoading, setIsLoading] = useState(false)
  const [error, setError] = useState("")
  const router = useRouter()

  const handleSubmit = async (e: React.FormEvent) => {
    e.preventDefault()
    setIsLoading(true)
    setError("")

    try {
      const result = await signIn("credentials", {
        email,
        password,
        redirect: false,
      })

      if (result?.error) {
        setError("Credenciais inválidas. Verifique seu email e senha.")
      } else {
        router.push("/")
        router.refresh()
      }
    } catch (error) {
      setError("Erro ao fazer login. Tente novamente.")
    } finally {
      setIsLoading(false)
    }
  }
  // ... form JSX
}

import { useSession } from "next-auth/react";
import { useRouter } from "next/navigation";
import { useEffect } from "react";

export default function LoginPage() {
  const { data: session, status } = useSession();
  const router = useRouter();

  useEffect(() => {
    if (status === "authenticated") {
      router.push("/dashboard");
      router.refresh();
    }
  }, [status, router]);

  if (status === "loading") {
    return <div>Carregando...</div>;
  }

  if (status === "authenticated") {
    return <div>Redirecionando...</div>;
  }

  return <LoginForm />;
}

import { withAuth } from "next-auth/middleware"
import { NextResponse } from "next/server"

export default withAuth(
  function middleware(req) {
    const token = req.nextauth.token
    const pathname = req.nextUrl.pathname

    // Define as permissões mínimas para cada rota
    const routePermissions: Record<string, number> = {
      "/dashboard/usuarios": 2, // Secretário (2) ou superior (Admin = 1)
      "/dashboard/usuarios/criar": 2,
      "/dashboard/usuarios/permissoes": 1, // Apenas Admin
    }

    // Verifica se a rota tem restrições
    for (const [route, maxRoleId] of Object.entries(routePermissions)) {
      if (pathname.startsWith(route)) {
        const userRoleId = token?.roleId as number
        
        if (!userRoleId || userRoleId > maxRoleId) {
          return NextResponse.redirect(new URL('/dashboard/unauthorized', req.url))
        }
      }
    }

    return NextResponse.next()
  },
  {
    callbacks: {
      authorized: ({ token }) => !!token
    },
  }
)

export const config = {
  matcher: ["/dashboard/:path*"]
}