first commit

src/modules/auth/strategies/google.strategy.ts

@@ -0,0 +1,42 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { Profile, Strategy, VerifyCallback } from 'passport-google-oauth20';
+
+@Injectable()
+export class GoogleStrategy extends PassportStrategy(Strategy, 'google') {
+  constructor(configService: ConfigService) {
+    super({
+      clientID:
+        configService.get<string>('google.clientId', { infer: true }) || 'missing-google-client-id',
+      clientSecret:
+        configService.get<string>('google.clientSecret', { infer: true }) ||
+        'missing-google-client-secret',
+      callbackURL:
+        configService.get<string>('google.callbackUrl', { infer: true }) ||
+        'http://localhost:4000/api/v1/auth/google/callback',
+      scope: ['email', 'profile'],
+    });
+  }
+
+  validate(
+    _accessToken: string,
+    _refreshToken: string,
+    profile: Profile,
+    done: VerifyCallback,
+  ): void {
+    const email = profile.emails?.[0]?.value?.toLowerCase();
+
+    if (!email) {
+      done(new UnauthorizedException('Google account email is not available'));
+      return;
+    }
+
+    done(null, {
+      googleId: profile.id,
+      email,
+      name: profile.displayName ?? 'Google User',
+      avatar: profile.photos?.[0]?.value,
+    });
+  }
+}

src/modules/auth/strategies/jwt-refresh.strategy.ts

@@ -0,0 +1,26 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { Request } from 'express';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { JwtPayload } from '../../../common/interfaces/jwt-payload.interface';
+
+@Injectable()
+export class JwtRefreshStrategy extends PassportStrategy(Strategy, 'jwt-refresh') {
+  constructor(configService: ConfigService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromBodyField('refreshToken'),
+      ignoreExpiration: false,
+      secretOrKey: configService.get<string>('jwt.refreshSecret', { infer: true }),
+      passReqToCallback: true,
+    });
+  }
+
+  validate(_: Request, payload: JwtPayload): JwtPayload {
+    if (payload.tokenType !== 'refresh') {
+      throw new UnauthorizedException('Invalid token type');
+    }
+
+    return payload;
+  }
+}

src/modules/auth/strategies/jwt.strategy.ts

@@ -0,0 +1,24 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { JwtPayload } from '../../../common/interfaces/jwt-payload.interface';
+
+@Injectable()
+export class JwtStrategy extends PassportStrategy(Strategy, 'jwt') {
+  constructor(configService: ConfigService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: configService.get<string>('jwt.accessSecret', { infer: true }),
+    });
+  }
+
+  validate(payload: JwtPayload): JwtPayload {
+    if (payload.tokenType !== 'access') {
+      throw new UnauthorizedException('Invalid token type');
+    }
+
+    return payload;
+  }
+}

src/modules/auth/strategies/super-admin-jwt.strategy.ts

@@ -0,0 +1,24 @@
+import { Injectable, UnauthorizedException } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PassportStrategy } from '@nestjs/passport';
+import { ExtractJwt, Strategy } from 'passport-jwt';
+import { JwtPayload } from '../../../common/interfaces/jwt-payload.interface';
+
+@Injectable()
+export class SuperAdminJwtStrategy extends PassportStrategy(Strategy, 'superadmin-jwt') {
+  constructor(configService: ConfigService) {
+    super({
+      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
+      ignoreExpiration: false,
+      secretOrKey: configService.get<string>('superAdmin.accessSecret', { infer: true }),
+    });
+  }
+
+  validate(payload: JwtPayload): JwtPayload {
+    if (payload.tokenType !== 'superadmin_access') {
+      throw new UnauthorizedException('Invalid superadmin token');
+    }
+
+    return payload;
+  }
+}