schalli
6190f3dd39
- Create LocalStrategy (username/password via argon2) and JwtStrategy (cookie extractor) - Create JwtAuthGuard with @Public() decorator support for route opt-out - Create RolesGuard checking SUPER_ADMIN/ADMIN/USER roles per D-12 - Create AuthService with validateUser, login (30-day httpOnly cookie), logout - Create AuthController with POST /auth/login, POST /auth/logout, GET /auth/me - Create LoginDto with class-validator decorators - Create @Public, @Roles, @CurrentUser decorators - Update main.ts with ValidationPipe, CORS credentials, cookie-parser - Install cookie-parser for httpOnly JWT cookie support
21 lines
731 B
TypeScript
21 lines
731 B
TypeScript
import { Injectable, UnauthorizedException } from '@nestjs/common';
|
|
import { PassportStrategy } from '@nestjs/passport';
|
|
import { Strategy } from 'passport-local';
|
|
import { AuthService } from '../auth.service';
|
|
|
|
@Injectable()
|
|
export class LocalStrategy extends PassportStrategy(Strategy) {
|
|
constructor(private authService: AuthService) {
|
|
super({ usernameField: 'username' });
|
|
}
|
|
|
|
async validate(username: string, password: string): Promise<any> {
|
|
const user = await this.authService.validateUser(username, password);
|
|
if (!user) {
|
|
// T-02-01: Generic error message - never reveal whether username or password is wrong
|
|
throw new UnauthorizedException('Invalid credentials');
|
|
}
|
|
return user;
|
|
}
|
|
}
|