FEAT: set cookie after user login

src/modules/auth/auth.controller.ts

@@ -12,6 +12,7 @@ import {
   Redirect,
   Req,
   Param,
+  Res,
 } from '@nestjs/common';
 import {
   ApiHeaders,
@@ -47,9 +48,9 @@ import {
 } from './dtos/login';
 import { PackTheMetadata } from 'src/utils/PackTheMetadata';
 import { AuthGuard } from '@nestjs/passport';
-import { Request } from 'express';
+import { Request, Response } from 'express';
 import ErrorCodes, { OauthErrors } from 'src/utils/errorCodes';
-import jwt from 'jsonwebtoken';
+import jwt, { JwtPayload } from 'jsonwebtoken';
 import { LanguageEnum } from 'src/utils/languages.enum';
 import { Language } from 'src/decorators/language.decorator';
 import { ApiInternalOnlyEndpoint } from 'src/decorators/swagger.decorator';
@@ -86,11 +87,20 @@ export class AuthController {
   async signIn(
     @Body() { username, password, totp }: AuthSignInReq,
     @Language() language: LanguageEnum,
-  ): Promise<AuthSignInRes> {
-    this.logger.info('/auth - SignIn');
-    const metadata = PackTheMetadata({ language });
-    this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
-    return this.authClient.signIn({ username, password, totp }, metadata);
+    @Res() res: Response,
+  ) {
+    try {
+      this.logger.info('/auth - SignIn');
+      const metadata = PackTheMetadata({ language });
+      this.logger.info('metadata: ' + JSON.stringify(metadata.toJSON()));
+      const data = await this.authClient.signIn({ username, password, totp }, metadata);
+      this.addTokenInCookie(res, data.tokens);
+
+      return res.send(data);
+    } catch (error) {
+      this.logger.error('/auth - SignIn - ERROR', error);
+    }
+
   }
 
   @Post('refresh-access-token')
@@ -100,17 +110,23 @@ export class AuthController {
     @Body() body: AuthRefreshAccessTokenReq,
     @Language() language: LanguageEnum,
     @Headers('origin') origin: string,
+    @Res() res: Response,
   ) {
     this.logger.info('/auth - RefreshAccessToken');
     const { refreshToken, customerName: customer_name } = body;
-    const frontHost = origin.replace(/^https?:\/\//, '');
+
     const metadata = PackTheMetadata({
       language,
       customer_name,
-      custom_host: frontHost,
     });
 
-    return this.authClient.refreshAccessToken({ refreshToken }, metadata);
+    const data = await this.authClient.refreshAccessToken({ refreshToken }, metadata);
+
+    this.addTokenInCookie(res, {
+      accessToken: data.accessToken,
+    });
+
+    return res.send(data);
   }
 
   @ApiInternalOnlyEndpoint()
@@ -418,4 +434,93 @@ export class AuthController {
 
     return this.authClient.resetUsers(body.users, metadata);
   }
+
+  @Get('me')
+  async getMe(@Req() req: Request, @Res() res: Response) {
+    // Lê cookies
+    const accessToken = req.cookies['ddf-auth'];
+    const refreshToken = req.cookies['ddf-refresh-auth'];
+
+    console.log(req.cookies)
+    let payload: any;
+    let userInfo: any = {};
+    try {
+      // Decodifica e valida o JWT de acesso
+      const decoded: any = accessToken && jwt.decode(accessToken, { complete: true });
+      if (!decoded) throw new Error('Invalid token');
+      const { kid } = decoded.header;
+      // Busca a chave pública
+      const { keys } = await this.authClient.getPublicKeys();
+      const pemValue = keys.find((k) => k.kid === kid)?.pem;
+      if (!pemValue) throw new Error('Public key not found');
+      jwt.verify(accessToken, pemValue);
+      payload = decoded.payload;
+      userInfo = {
+        id: payload.user_id,
+        name: payload.username,
+        customer: {
+          id: payload.customer_id,
+          name: payload.customer_name,
+          tier: payload.customer_tier,
+        }
+      };
+      return res.status(200).json(userInfo);
+    } catch (err) {
+      // Se access token inválido, tenta refresh
+      if (!refreshToken) {
+        return res.status(401).json({ error: 'Not authenticated' });
+      }
+      try {
+        // Chama refreshAccessToken
+        const metadata = PackTheMetadata({});
+        const data = await this.authClient.refreshAccessToken({ refreshToken }, metadata);
+        // Retorna novo access token e dados mínimos
+        this.addTokenInCookie(res, {
+          accessToken: data.accessToken,
+        });
+        // Decodifica novo token
+        const decoded: any = jwt.decode(data.accessToken, { complete: true });
+        const payload = decoded.payload;
+        userInfo = {
+          id: payload.user_id,
+          name: payload.username,
+          customer: {
+            id: payload.customer_id,
+            name: payload.customer_name,
+            tier: payload.customer_tier,
+          }
+        };
+        return res.status(200).json(userInfo);
+      } catch (refreshErr) {
+        return res.status(401).json({ error: 'Not authenticated' });
+      }
+    }
+  }
+
+  private addTokenInCookie(res: Response, tokens: { accessToken?: string, refreshToken?: string }) {
+    let exp = 1000 * 60 * 5; // 5 minutes
+
+    if (tokens.accessToken) {
+      const { exp: expiration } = jwt.decode(tokens.accessToken) as JwtPayload;
+      exp = (expiration - 30) * 1000; // exp em segundos, maxAge em ms
+
+      res.cookie('ddf-auth', tokens.accessToken, {
+        domain: 'dadosfera.local',
+        maxAge: exp,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
+    }
+
+    if (tokens.refreshToken) {
+      res.cookie('ddf-refresh-auth', tokens.refreshToken, {
+        domain: 'dadosfera.local',
+        maxAge: exp,
+        httpOnly: true,
+        secure: true,
+        sameSite: 'none', // Necessário para cookies em requisições cross-site
+      });
+    }
+  }
 }