Implémenter le premier domaine métier réellement exécutable de la plateforme.

À l'issue du Sprint 1 :

✓ Register

✓ Login

✓ JWT

✓ Refresh Token

✓ RBAC

✓ Current User

✓ Swagger

✓ Unit Tests

✓ E2E Tests

Le système devient capable :

Créer un utilisateur

S'authentifier

Gérer les rôles

Sécuriser les endpoints

AuthModule

UsersModule

SecurityModule

User

Role

Permission

UserRole

RolePermission

RefreshToken

Session

model User {
 
  id              String @id @default(uuid())
 
  tenantId        String
 
  email           String @unique
 
  passwordHash    String
 
  firstName       String
 
  lastName        String
 
  phone           String?
 
  status          UserStatus
 
  createdAt       DateTime @default(now())
 
  updatedAt       DateTime @updatedAt
 
  deletedAt       DateTime?
 
  tenant          Tenant @relation(
                    fields:[tenantId],
                    references:[id]
                  )
 
  roles           UserRole[]
 
  refreshTokens   RefreshToken[]
 
  sessions        Session[]
}

model RefreshToken {
 
  id            String @id @default(uuid())
 
  userId        String
 
  tokenHash     String
 
  expiresAt     DateTime
 
  revokedAt     DateTime?
 
  createdAt     DateTime @default(now())
 
  user          User
    @relation(
      fields:[userId],
      references:[id]
    )
}

model Session {
 
  id            String @id @default(uuid())
 
  userId        String
 
  ipAddress     String?
 
  userAgent     String?
 
  createdAt     DateTime @default(now())
 
  lastSeenAt    DateTime
 
  user          User
    @relation(
      fields:[userId],
      references:[id]
    )
}

npm install @nestjs/jwt
 
npm install @nestjs/passport
 
npm install passport
 
npm install passport-jwt
 
npm install passport-local
 
npm install bcrypt
 
npm install class-validator
 
npm install class-transformer

npm install -D
 
@types/bcrypt
 
@types/passport-jwt
 
@types/passport-local

src/modules/auth

├── application

├── domain

├── infrastructure

├── presentation

└── auth.module.ts

commands

queries

handlers

dto

export class RegisterDto {
 
  @IsEmail()
  email: string;
 
  @MinLength(8)
  password: string;
 
  @IsString()
  firstName: string;
 
  @IsString()
  lastName: string;
}

export class LoginDto {
 
  @IsEmail()
  email: string;
 
  @IsString()
  password: string;
}

export class RefreshTokenDto {
 
  @IsString()
  refreshToken: string;
}

src/modules/auth/domain/services

hash()
 
compare()

const hash =
  await bcrypt.hash(password, 12);

JWT_SECRET

JWT_EXPIRES_IN

REFRESH_SECRET

REFRESH_EXPIRES_IN

JWT_SECRET=super-secret

JWT_EXPIRES_IN=15m

REFRESH_SECRET=refresh-secret

REFRESH_EXPIRES_IN=30d

export interface JwtPayload {
 
  sub: string;
 
  tenantId: string;
 
  email: string;
}

POST /auth/register

Validation

↓

Email unique

↓

Hash password

↓

Create User

↓

Assign Role USER

↓

Return JWT

{
  "accessToken": "...",
  "refreshToken": "...",
  "user": {}
}

POST /auth/login

Find User

↓

Compare Password

↓

Generate JWT

↓

Generate Refresh Token

↓

Create Session

POST /auth/refresh

Validate Refresh Token

↓

Generate New JWT

↓

Rotate Refresh Token

POST /auth/logout

Révocation Refresh Token

Suppression Session

GET /auth/me

{
  "id": "...",
  "email": "...",
  "roles": ["USER"]
}

jwt.strategy.ts

Bearer Token

↓

Verify JWT

↓

Load User

↓

Inject Request.user

@Roles('ADMIN')

RolesGuard

@Roles('ADMIN')
 
@Get()
findAll()

@Permissions(
  'users.read'
)

PermissionsGuard

RolePermission

Permission

@ApiTags('Auth')

@ApiBearerAuth()

POST /auth/register

POST /auth/login

POST /auth/refresh

POST /auth/logout

GET  /auth/me

users.read

users.create

users.update

users.delete

SUPER_ADMIN

ADMIN

MANAGER

OWNER

CUSTOMER

admin@platform.local

AuthService

PasswordService

JwtService

RolesGuard

PermissionsGuard

nx test api

Register

↓

Login

↓

Access Protected Route

↓

Refresh Token

↓

Logout

nx e2e api-e2e

Utilisateur créé

Mot de passe hashé

JWT retourné

JWT valide

Refresh Token valide

ADMIN autorisé

USER refusé

100 % documenté

AuthModule

JwtStrategy

AuthController

AuthService

RolesGuard

PermissionsGuard

RegisterDto

LoginDto

RefreshTokenDto

Swagger

Tests

Implémenter le premier domaine métier réellement exécutable de la plateforme.

À l'issue du Sprint 1 :

✓ Register

✓ Login

✓ JWT

✓ Refresh Token

✓ RBAC

✓ Current User

✓ Swagger

✓ Unit Tests

✓ E2E Tests

Le système devient capable :

Créer un utilisateur

S'authentifier

Gérer les rôles

Sécuriser les endpoints

AuthModule

UsersModule

SecurityModule

User

Role

Permission

UserRole

RolePermission

RefreshToken

Session

model User {
 
  id              String @id @default(uuid())
 
  tenantId        String
 
  email           String @unique
 
  passwordHash    String
 
  firstName       String
 
  lastName        String
 
  phone           String?
 
  status          UserStatus
 
  createdAt       DateTime @default(now())
 
  updatedAt       DateTime @updatedAt
 
  deletedAt       DateTime?
 
  tenant          Tenant @relation(
                    fields:[tenantId],
                    references:[id]
                  )
 
  roles           UserRole[]
 
  refreshTokens   RefreshToken[]
 
  sessions        Session[]
}

model RefreshToken {
 
  id            String @id @default(uuid())
 
  userId        String
 
  tokenHash     String
 
  expiresAt     DateTime
 
  revokedAt     DateTime?
 
  createdAt     DateTime @default(now())
 
  user          User
    @relation(
      fields:[userId],
      references:[id]
    )
}

model Session {
 
  id            String @id @default(uuid())
 
  userId        String
 
  ipAddress     String?
 
  userAgent     String?
 
  createdAt     DateTime @default(now())
 
  lastSeenAt    DateTime
 
  user          User
    @relation(
      fields:[userId],
      references:[id]
    )
}

npm install @nestjs/jwt
 
npm install @nestjs/passport
 
npm install passport
 
npm install passport-jwt
 
npm install passport-local
 
npm install bcrypt
 
npm install class-validator
 
npm install class-transformer

npm install -D
 
@types/bcrypt
 
@types/passport-jwt
 
@types/passport-local

src/modules/auth

├── application

├── domain

├── infrastructure

├── presentation

└── auth.module.ts

commands

queries

handlers

dto

export class RegisterDto {
 
  @IsEmail()
  email: string;
 
  @MinLength(8)
  password: string;
 
  @IsString()
  firstName: string;
 
  @IsString()
  lastName: string;
}

export class LoginDto {
 
  @IsEmail()
  email: string;
 
  @IsString()
  password: string;
}

export class RefreshTokenDto {
 
  @IsString()
  refreshToken: string;
}

src/modules/auth/domain/services

hash()
 
compare()

const hash =
  await bcrypt.hash(password, 12);

JWT_SECRET

JWT_EXPIRES_IN

REFRESH_SECRET

REFRESH_EXPIRES_IN

JWT_SECRET=super-secret

JWT_EXPIRES_IN=15m

REFRESH_SECRET=refresh-secret

REFRESH_EXPIRES_IN=30d

export interface JwtPayload {
 
  sub: string;
 
  tenantId: string;
 
  email: string;
}

POST /auth/register

Validation

↓

Email unique

↓

Hash password

↓

Create User

↓

Assign Role USER

↓

Return JWT

{
  "accessToken": "...",
  "refreshToken": "...",
  "user": {}
}

POST /auth/login

Find User

↓

Compare Password

↓

Generate JWT

↓

Generate Refresh Token

↓

Create Session

POST /auth/refresh

Validate Refresh Token

↓

Generate New JWT

↓

Rotate Refresh Token

POST /auth/logout

Révocation Refresh Token

Suppression Session

GET /auth/me

{
  "id": "...",
  "email": "...",
  "roles": ["USER"]
}

jwt.strategy.ts

Bearer Token

↓

Verify JWT

↓

Load User

↓

Inject Request.user

@Roles('ADMIN')

RolesGuard

@Roles('ADMIN')
 
@Get()
findAll()

@Permissions(
  'users.read'
)

PermissionsGuard

RolePermission

Permission

@ApiTags('Auth')

@ApiBearerAuth()

POST /auth/register

POST /auth/login

POST /auth/refresh

POST /auth/logout

GET  /auth/me

users.read

users.create

users.update

users.delete

SUPER_ADMIN

ADMIN

MANAGER

OWNER

CUSTOMER

admin@platform.local

AuthService

PasswordService

JwtService

RolesGuard

PermissionsGuard

nx test api

Register

↓

Login

↓

Access Protected Route

↓

Refresh Token

↓

Logout

nx e2e api-e2e

Utilisateur créé

Mot de passe hashé

JWT retourné

JWT valide

Refresh Token valide

ADMIN autorisé

USER refusé

100 % documenté

AuthModule

JwtStrategy

AuthController

AuthService

RolesGuard

PermissionsGuard

RegisterDto

LoginDto

RefreshTokenDto

Swagger

Tests

Implémenter réellement les entités Prisma nécessaires à :

Register

Login

JWT

Refresh Token

RBAC

Sessions

avant toute écriture de code NestJS.

Cette étape produit :

User

Role

Permission

UserRole

RolePermission

RefreshToken

Session

dans le fichier :

apps/api/prisma/schema.prisma

enum UserStatus {
 
  ACTIVE
 
  INACTIVE
 
  BLOCKED
 
  PENDING
}

model User {
 
  id                String @id @default(uuid())
 
  tenantId          String
 
  email             String @unique
 
  passwordHash      String
 
  firstName         String
 
  lastName          String
 
  phone             String?
 
  status            UserStatus @default(ACTIVE)
 
  emailVerified     Boolean @default(false)
 
  lastLoginAt       DateTime?
 
  createdAt         DateTime @default(now())
 
  updatedAt         DateTime @updatedAt
 
  deletedAt         DateTime?
 
  createdBy         String?
 
  updatedBy         String?
 
  tenant            Tenant
                     @relation(
                       fields:[tenantId],
                       references:[id]
                     )
 
  userRoles         UserRole[]
 
  refreshTokens     RefreshToken[]
 
  sessions          Session[]
 
  @@index([tenantId])
 
  @@index([email])
 
  @@index([status])
 
  @@index([deletedAt])
}

model Role {
 
  id                String @id @default(uuid())
 
  tenantId          String
 
  code              String
 
  name              String
 
  description       String?
 
  createdAt         DateTime @default(now())
 
  updatedAt         DateTime @updatedAt
 
  deletedAt         DateTime?
 
  tenant            Tenant
                     @relation(
                       fields:[tenantId],
                       references:[id]
                     )
 
  userRoles         UserRole[]
 
  rolePermissions   RolePermission[]
 
  @@unique([tenantId, code])
 
  @@index([tenantId])
 
  @@index([code])
}

model Permission {
 
  id                String @id @default(uuid())
 
  code              String @unique
 
  name              String
 
  description       String?
 
  createdAt         DateTime @default(now())
 
  updatedAt         DateTime @updatedAt
 
  rolePermissions   RolePermission[]
 
  @@index([code])
}

model UserRole {
 
  id                String @id @default(uuid())
 
  userId            String
 
  roleId            String
 
  assignedAt        DateTime @default(now())
 
  assignedBy        String?
 
  user              User
                     @relation(
                       fields:[userId],
                       references:[id]
                     )
 
  role              Role
                     @relation(
                       fields:[roleId],
                       references:[id]
                     )
 
  @@unique([userId, roleId])
 
  @@index([userId])
 
  @@index([roleId])
}

model RolePermission {
 
  id                String @id @default(uuid())
 
  roleId            String
 
  permissionId      String
 
  role              Role
                     @relation(
                       fields:[roleId],
                       references:[id]
                     )
 
  permission        Permission
                     @relation(
                       fields:[permissionId],
                       references:[id]
                     )
 
  @@unique([
    roleId,
    permissionId
  ])
 
  @@index([roleId])
 
  @@index([permissionId])
}

model RefreshToken {
 
  id                String @id @default(uuid())
 
  userId            String
 
  tokenHash         String
 
  expiresAt         DateTime
 
  revokedAt         DateTime?
 
  createdAt         DateTime @default(now())
 
  user              User
                     @relation(
                       fields:[userId],
                       references:[id]
                     )
 
  @@index([userId])
 
  @@index([expiresAt])
 
  @@index([revokedAt])
}

model Session {
 
  id                String @id @default(uuid())
 
  userId            String
 
  ipAddress         String?
 
  country           String?
 
  userAgent         String?
 
  device            String?
 
  lastSeenAt        DateTime
 
  createdAt         DateTime @default(now())
 
  revokedAt         DateTime?
 
  user              User
                     @relation(
                       fields:[userId],
                       references:[id]
                     )
 
  @@index([userId])
 
  @@index([lastSeenAt])
 
  @@index([revokedAt])
}

Le modèle :

Tenant

doit contenir :

users User[]
 
roles Role[]

model Tenant {
 
  id                String @id @default(uuid())
 
  code              String @unique
 
  name              String
 
  active            Boolean @default(true)
 
  users             User[]
 
  roles             Role[]
 
  createdAt         DateTime @default(now())
 
  updatedAt         DateTime @updatedAt
}

cd apps/api
 
npx prisma validate

The schema at prisma/schema.prisma is valid

npx prisma format

npx prisma migrate dev \
--name auth_module

prisma/migrations

└── xxxx_auth_module

    └── migration.sql

npx prisma generate

docker exec -it postgres psql -U postgres

\c rental_platform

\d "User"
 
\d "Role"
 
\d "Permission"
 
\d "UserRole"
 
\d "RolePermission"
 
\d "RefreshToken"
 
\d "Session"

Le Sprint 1-A.1 est terminé lorsque :

✓ User créé

✓ Role créé

✓ Permission créée

✓ UserRole créé

✓ RolePermission créé

✓ RefreshToken créé

✓ Session créée

✓ Migration exécutée

✓ Prisma Client généré

✓ Validation Prisma verte

schema.prisma

migration auth_module

Prisma Client

Créer automatiquement les données minimales nécessaires au démarrage de la plateforme.

À l'issue de cette étape :

✓ Tenant principal créé

✓ Permissions créées

✓ Rôles créés

✓ Super Administrateur créé

✓ Affectation des permissions

✓ Affectation du rôle Super Admin

✓ Première connexion possible

apps/api/prisma/seed.ts

Créer Tenant

Créer Permissions

Créer Rôles

Créer Super Admin

Associer les permissions

Associer les rôles

npm install bcrypt
 
npm install -D @types/bcrypt

{
  "prisma": {
    "seed": "tsx prisma/seed.ts"
  }
}

npm install -D tsx

apps/api/prisma/seed.ts

import { PrismaClient } from '@prisma/client';
import * as bcrypt from 'bcrypt';
 
const prisma = new PrismaClient();
 
async function main() {
 
  console.log('Starting seed...');
}
 
main()
  .then(() => prisma.$disconnect())
  .catch(async (error) => {
 
    console.error(error);
 
    await prisma.$disconnect();
 
    process.exit(1);
  });

const tenant =
  await prisma.tenant.upsert({
 
    where: {
      code: 'MAIN'
    },
 
    update: {},
 
    create: {
 
      code: 'MAIN',
 
      name: 'Main Tenant',
 
      active: true
    }
  });

MAIN

devient le tenant par défaut.

users.read
users.create
users.update
users.delete

roles.read
roles.manage

properties.read
properties.create
properties.update
properties.delete

reservations.read
reservations.create
reservations.update
reservations.delete

payments.read
payments.create

crm.read
crm.manage

security.read
security.manage

const permissions = [
 
  'users.read',
  'users.create',
  'users.update',
  'users.delete',
 
  'roles.read',
  'roles.manage',
 
  'properties.read',
  'properties.create',
  'properties.update',
  'properties.delete',
 
  'reservations.read',
  'reservations.create',
  'reservations.update',
  'reservations.delete',
 
  'payments.read',
  'payments.create',
 
  'crm.read',
  'crm.manage',
 
  'security.read',
  'security.manage'
];

for (const code of permissions) {
 
  await prisma.permission.upsert({
 
    where: { code },
 
    update: {},
 
    create: {
 
      code,
 
      name: code
    }
  });
}

SUPER_ADMIN

ADMIN

MANAGER

OWNER

CUSTOMER

const superAdminRole =
  await prisma.role.upsert({
 
    where: {
 
      tenantId_code: {
 
        tenantId: tenant.id,
 
        code: 'SUPER_ADMIN'
      }
    },
 
    update: {},
 
    create: {
 
      tenantId: tenant.id,
 
      code: 'SUPER_ADMIN',
 
      name: 'Super Administrateur'
    }
  });

ADMIN

MANAGER

OWNER

CUSTOMER

const allPermissions =
  await prisma.permission.findMany();

for (const permission of allPermissions) {
 
  await prisma.rolePermission.upsert({
 
    where: {
 
      roleId_permissionId: {
 
        roleId: superAdminRole.id,
 
        permissionId: permission.id
      }
    },
 
    update: {},
 
    create: {
 
      roleId: superAdminRole.id,
 
      permissionId: permission.id
    }
  });
}

SUPER_ADMIN

↓

Toutes les permissions

admin@platform.local

Admin123!

const passwordHash =
  await bcrypt.hash(
    'Admin123!',
    12
  );

const admin =
  await prisma.user.upsert({
 
    where: {
 
      email: 'admin@platform.local'
    },
 
    update: {},
 
    create: {
 
      tenantId: tenant.id,
 
      email: 'admin@platform.local',
 
      passwordHash,
 
      firstName: 'Super',
 
      lastName: 'Admin',
 
      emailVerified: true,
 
      status: 'ACTIVE'
    }
  });

await prisma.userRole.upsert({
 
  where: {
 
    userId_roleId: {
 
      userId: admin.id,
 
      roleId: superAdminRole.id
    }
  },
 
  update: {},
 
  create: {
 
    userId: admin.id,
 
    roleId: superAdminRole.id
  }
});

console.log(
  'Tenant created:',
  tenant.code
);
 
console.log(
  'Admin:',
  admin.email
);
 
console.log(
  'Seed completed'
);

cd apps/api
 
npx prisma db seed

Starting seed...

Tenant created: MAIN

Admin: admin@platform.local

Seed completed

npx prisma studio

Tenant

User

Role

Permission

UserRole

RolePermission

SELECT email
 
FROM "User";

admin@platform.local

SELECT COUNT(*)
 
FROM "Permission";

> 15

Admin123!

en production.

ADMIN_EMAIL

ADMIN_PASSWORD

dans :

.env

pour les environnements réels.

Le Sprint 1-A.2 est terminé lorsque :

✓ Tenant créé

✓ Permissions créées

✓ Rôles créés

✓ Super Admin créé

✓ Affectation des permissions

✓ Affectation du rôle

✓ Seed exécutable

✓ Première connexion possible

prisma/seed.ts

package.json

Permissions système

Rôles système

Compte Super Admin

Implémenter le premier module métier réellement exécutable de la plateforme.

À l'issue de cette étape :

✓ AuthModule

✓ AuthController

✓ AuthService

✓ PasswordService

✓ JwtStrategy

✓ JwtAuthGuard

✓ Register

✓ Login

✓ Refresh

✓ Logout

✓ Current User

Créer :

apps/api/src/modules/auth

auth

├── application
│
│   ├── dto
│   ├── commands
│   ├── queries
│   └── handlers
│
├── domain
│
│   └── services
│
├── infrastructure
│
│   └── strategies
│
├── presentation
│
│   ├── controllers
│   └── guards
│
└── auth.module.ts

auth.module.ts

import { Module } from '@nestjs/common';
import { JwtModule } from '@nestjs/jwt';
 
import { AuthController } from './presentation/controllers/auth.controller';
import { AuthService } from './domain/services/auth.service';
import { PasswordService } from './domain/services/password.service';
import { JwtStrategy } from './infrastructure/strategies/jwt.strategy';
 
@Module({
 
  imports: [
 
    JwtModule.register({})
  ],
 
  controllers: [
 
    AuthController
  ],
 
  providers: [
 
    AuthService,
 
    PasswordService,
 
    JwtStrategy
  ],
 
  exports: [
 
    AuthService
  ]
})
export class AuthModule {}

application/dto/register.dto.ts

import {
  IsEmail,
  IsString,
  MinLength
} from 'class-validator';
 
export class RegisterDto {
 
  @IsEmail()
  email: string;
 
  @MinLength(8)
  password: string;
 
  @IsString()
  firstName: string;
 
  @IsString()
  lastName: string;
}

application/dto/login.dto.ts

import {
  IsEmail,
  IsString
} from 'class-validator';
 
export class LoginDto {
 
  @IsEmail()
  email: string;
 
  @IsString()
  password: string;
}

application/dto/refresh-token.dto.ts

import {
  IsString
} from 'class-validator';
 
export class RefreshTokenDto {
 
  @IsString()
  refreshToken: string;
}

domain/services/password.service.ts

import * as bcrypt from 'bcrypt';
 
export class PasswordService {
 
  async hash(
    password: string
  ): Promise<string> {
 
    return bcrypt.hash(
      password,
      12
    );
  }
 
  async compare(
    password: string,
    hash: string
  ): Promise<boolean> {
 
    return bcrypt.compare(
      password,
      hash
    );
  }
}

domain/services/auth.service.ts

Register

Login

Refresh

Logout

Current User

@Injectable()
export class AuthService {
 
  async register() {}
 
  async login() {}
 
  async refresh() {}
 
  async logout() {}
 
  async me() {}
}

infrastructure/strategies/jwt-payload.interface.ts

export interface JwtPayload {
 
  sub: string;
 
  tenantId: string;
 
  email: string;
}

infrastructure/strategies/jwt.strategy.ts

@Injectable()
export class JwtStrategy
extends PassportStrategy(
  Strategy
) {
 
  constructor() {
 
    super({
 
      jwtFromRequest:
        ExtractJwt.fromAuthHeaderAsBearerToken(),
 
      ignoreExpiration: false,
 
      secretOrKey:
        process.env.JWT_SECRET
    });
  }
 
  async validate(
    payload: JwtPayload
  ) {
 
    return payload;
  }
}

presentation/guards/jwt-auth.guard.ts

@Injectable()
export class JwtAuthGuard
extends AuthGuard('jwt') {}

presentation/controllers/auth.controller.ts

@ApiTags('Auth')
 
@Controller('auth')
 
export class AuthController {
 
}

POST /auth/register

@Post('register')
 
register(
  @Body()
  dto: RegisterDto
) {
 
  return this.authService
    .register(dto);
}

POST /auth/login

@Post('login')
 
login(
  @Body()
  dto: LoginDto
) {
 
  return this.authService
    .login(dto);
}

POST /auth/refresh

@Post('refresh')
 
refresh(
  @Body()
  dto: RefreshTokenDto
) {
 
  return this.authService
    .refresh(dto);
}

POST /auth/logout

@UseGuards(
  JwtAuthGuard
)

@Post('logout')
 
logout(
  @Req() req
) {
 
  return this.authService
    .logout(
      req.user.sub
    );
}

GET /auth/me

@UseGuards(
  JwtAuthGuard
)

@Get('me')
 
me(
  @Req() req
) {
 
  return this.authService
    .me(
      req.user.sub
    );
}

JWT_SECRET=change-me

JWT_EXPIRES_IN=15m

REFRESH_SECRET=change-me-too

REFRESH_EXPIRES_IN=30d

Ajouter :

imports: [
 
  AuthModule
]

nx build api

SUCCESS

/auth/register

/auth/login

/auth/refresh

/auth/logout

/auth/me

doivent apparaître dans :

http://localhost:3000/api

Le Sprint 1-B.1 est terminé lorsque :

✓ AuthModule créé

✓ DTO créés

✓ PasswordService créé

✓ JwtStrategy créée

✓ JwtAuthGuard créé

✓ AuthController créé

✓ Endpoints exposés

✓ Swagger visible

✓ Build vert

AuthModule

AuthController

AuthService

PasswordService

JwtStrategy

JwtAuthGuard

RegisterDto

LoginDto

RefreshTokenDto

Rendre le endpoint :

POST /auth/register

entièrement fonctionnel.

À l'issue de cette étape :

✓ Vérification email unique

✓ Hash du mot de passe

✓ Création User

✓ Attribution rôle CUSTOMER

✓ Création RefreshToken

✓ Génération JWT

✓ Retour utilisateur connecté

Register Request

↓

Validation DTO

↓

Vérification email

↓

Hash Password

↓

Create User

↓

Assign CUSTOMER Role

↓

Generate JWT

↓

Generate Refresh Token

↓

Persist Refresh Token

↓

Response

Créer :

application/dto/auth-response.dto.ts

export class AuthResponseDto {
 
  accessToken: string;
 
  refreshToken: string;
 
  user: {
 
    id: string;
 
    email: string;
 
    firstName: string;
 
    lastName: string;
  };
}

Le :

PrismaModule

doit exporter :

PrismaService

Ajouter :

imports: [
 
  PrismaModule,
 
  JwtModule.register({})
]

Modifier :

@Injectable()
export class AuthService {
 
  constructor(
 
    private readonly prisma: PrismaService,
 
    private readonly jwtService: JwtService,
 
    private readonly passwordService: PasswordService
  ) {}
}

Créer :

shared/constants/roles.constants.ts

export const SYSTEM_ROLES = {
 
  SUPER_ADMIN: 'SUPER_ADMIN',
 
  ADMIN: 'ADMIN',
 
  MANAGER: 'MANAGER',
 
  OWNER: 'OWNER',
 
  CUSTOMER: 'CUSTOMER'
};

async register(
  dto: RegisterDto
): Promise<AuthResponseDto>

const existingUser =
  await this.prisma.user.findUnique({
 
    where: {
 
      email: dto.email
    }
  });
 
if (existingUser) {
 
  throw new ConflictException(
    'Email already exists'
  );
}

const tenant =
  await this.prisma.tenant.findUnique({
 
    where: {
 
      code: 'MAIN'
    }
  });
 
if (!tenant) {
 
  throw new Error(
    'Main tenant not found'
  );
}

const passwordHash =
  await this.passwordService.hash(
    dto.password
  );

const user =
  await this.prisma.user.create({
 
    data: {
 
      tenantId: tenant.id,
 
      email: dto.email,
 
      passwordHash,
 
      firstName: dto.firstName,
 
      lastName: dto.lastName,
 
      status: 'ACTIVE'
    }
  });

const customerRole =
  await this.prisma.role.findFirst({
 
    where: {
 
      tenantId: tenant.id,
 
      code: SYSTEM_ROLES.CUSTOMER
    }
  });
 
if (!customerRole) {
 
  throw new Error(
    'Customer role missing'
  );
}

await this.prisma.userRole.create({
 
  data: {
 
    userId: user.id,
 
    roleId: customerRole.id
  }
});

const payload = {
 
  sub: user.id,
 
  tenantId: tenant.id,
 
  email: user.email
};

const accessToken =
  await this.jwtService.signAsync(
    payload,
    {
      secret:
        process.env.JWT_SECRET,
 
      expiresIn:
        process.env.JWT_EXPIRES_IN
    }
  );

const refreshToken =
  randomUUID();

const refreshTokenHash =
  await this.passwordService.hash(
    refreshToken
  );

await this.prisma.refreshToken.create({
 
  data: {
 
    userId: user.id,
 
    tokenHash: refreshTokenHash,
 
    expiresAt: addDays(
      new Date(),
      30
    )
  }
});

return {
 
  accessToken,
 
  refreshToken,
 
  user: {
 
    id: user.id,
 
    email: user.email,
 
    firstName: user.firstName,
 
    lastName: user.lastName
  }
};