Merge pull request #14 from DevAnseSenior/refresh-token

DevAnseSenior · web-flow · commit 7911146db52a · 2025-09-08T23:34:48.000-04:00
Refresh token
diff --git a/README.md b/README.md
@@ -27,26 +27,30 @@ go-gym-api/
 │ ├── migrations # stored migration history
 │ └── schema.prisma # Database tables schemas
 ├── src/
+│ ├── @types/ # Store globals interfaces on project
 │ ├── env/
 │ │ └── index.ts # Enviroment vars validation
 │ ├── http/
 │ │ ├── controllers/ # Handler of request response
-│ │ └── routes.ts # application endpoints
+│ │ └── middlewares # Functions to interact between controllers and endpoints
 │ ├── lib/
 │ │ └── prisma.ts # Prisma client config
 │ ├── repositories/ # Layer for database manipulation tools
 │ │ ├── in-memory/
 │ │ ├── prisma/
 │ │ ├── check-ins-repository.ts # Check-ins Interface
+│ │ ├── gyms-repository.ts # Check-ins Interface
 │ │ └── users-repository.ts # Users Interface
-│ ├── use-cases/ # Use case layer for specific entities
-│ │ ├── factories/ # Use case factories for instances
-│ │ └── errors/ # Use case error messages
+│ ├── use-cases/ # Use cases layer for entities
+│ │ ├── errors/ # Use case error messages
+│ │ └── factories/ # Use case factories for instances
 │ ├── utils/ # Application utility functions
+│ │ └── test/ # Utility functions for tests
 │ ├── app.ts # Fastify app setup
 │ └── server.ts # Server setup config
 ├── env.example # Enviroment variables example
 ├── .eslintrc.json # ESLint Config
+├── .gitignore
 ├── .npmrc # NPM config libs control
 ├── docker-compose.yml
 ├── LICENSE
@@ -86,7 +90,8 @@ go-gym-api/
 5. **Run tests**:
     ```bash
     docker compose up -d # Start the services
-    npm run test # Run the tests suit
+    npm run test # Run the unit tests suits
+    npm run test:e2e # Run the tests e2e suits
     npm run test:watch # Run the tests on watch mode
     npm run test:coverage # Verify the tests coverage (open index.html from dir coverage/)
     npm run test:ui # Execute the test client of vitest
@@ -96,6 +101,18 @@ go-gym-api/
 ### Users
 - POST /users → Register new user.
 - POST /sessions → Authenticate (login).
+- GET /me → Get logged user info.
+
+### Gyms
+- POST /gyms → Create a new gym.
+- GET /gyms/search → Search gym by title.
+- GET /gyms/nearby → Search nearby user localization gyms.
+
+### Check-ins
+- POST /gyms/:gymId/check-ins → Check-in.
+- PATCH /check-ins/:checkInId/validate → Gym validations check-in.
+- GET /check-ins/history → Get check-ins history.
+- GET /check-ins/metrics → Get check-ins count of logged user.
 
 ## 📄 License
 This project is licensed under MIT [License](./LICENSE).
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -41,6 +41,7 @@
     "vitest": "3.2.4"
   },
   "dependencies": {
+    "@fastify/cookie": "11.0.2",
     "@fastify/jwt": "10.0.0",
     "@prisma/client": "6.14.0",
     "bcryptjs": "3.0.2",
diff --git a/prisma/migrations/20250909015658_add_role_to_users/migration.sql b/prisma/migrations/20250909015658_add_role_to_users/migration.sql
@@ -0,0 +1,5 @@
+-- CreateEnum
+CREATE TYPE "public"."Role" AS ENUM ('ADMIN', 'MEMBER');
+
+-- AlterTable
+ALTER TABLE "public"."users" ADD COLUMN     "role" "public"."Role" NOT NULL DEFAULT 'MEMBER';
diff --git a/prisma/schema.prisma b/prisma/schema.prisma
@@ -14,11 +14,17 @@ datasource db {
   url      = env("DATABASE_URL")
 }
 
+enum Role {
+  ADMIN
+  MEMBER
+}
+
 model User {
   id            String   @id @default(uuid())
   name          String
   email         String   @unique
   password_hash String
+  role          Role     @default(MEMBER)
   created_at    DateTime @default(now())
 
   checkIns CheckIn[]
diff --git a/src/@types/fastify-jwt.d.ts b/src/@types/fastify-jwt.d.ts
@@ -3,6 +3,7 @@ import '@fastify/jwt'
 declare module '@fastify/jwt' {
   export interface FastifyJWT {
     user: {
+      role: 'ADMIN' | 'MEMBER'
       sub: string
     }
   }
diff --git a/src/app.ts b/src/app.ts
@@ -1,3 +1,4 @@
+import fastifyCookie from '@fastify/cookie'
 import fastifyJwt from '@fastify/jwt'
 import fastify from 'fastify'
 import { ZodError } from 'zod'
@@ -10,8 +11,17 @@ export const app = fastify()
 
 app.register(fastifyJwt, {
   secret: env.JWT_SECRET,
+  cookie: {
+    cookieName: 'refreshToken',
+    signed: false,
+  },
+  sign: {
+    expiresIn: '10m',
+  },
 })
 
+app.register(fastifyCookie)
+
 app.register(usersRoutes)
 app.register(gymsRoutes)
 app.register(checkInsRoutes)
diff --git a/src/http/controllers/check-ins/create.spec.ts b/src/http/controllers/check-ins/create.spec.ts
@@ -14,7 +14,7 @@ describe('Create Check-In (e2e)', () => {
   })
 
   it('should be able to create a check-in', async () => {
-    const { token } = await createAndAuthenticateUser(app)
+    const { token } = await createAndAuthenticateUser(app, true)
 
     const gym = await prisma.gym.create({
       data: {
diff --git a/src/http/controllers/check-ins/routes.ts b/src/http/controllers/check-ins/routes.ts
@@ -1,6 +1,7 @@
 import { verifyJwt } from '@/http/middlewares/verify-jwt'
 import { FastifyInstance } from 'fastify'
 
+import { verifyUserRole } from '@/http/middlewares/verify-user-role'
 import { create } from './create'
 import { history } from './history'
 import { metrics } from './metrics'
@@ -13,5 +14,10 @@ export async function checkInsRoutes(app: FastifyInstance) {
   app.get('/check-ins/metrics', metrics)
 
   app.post('/gyms/:gymId/check-ins', create)
-  app.patch('/check-ins/:checkInId/validate', validate)
+
+  app.patch(
+    '/check-ins/:checkInId/validate',
+    { onRequest: verifyUserRole('ADMIN') },
+    validate,
+  )
 }
diff --git a/src/http/controllers/check-ins/validate.spec.ts b/src/http/controllers/check-ins/validate.spec.ts
@@ -14,7 +14,7 @@ describe('Validate Check-In (e2e)', () => {
   })
 
   it('should be able to validate a check-in', async () => {
-    const { token } = await createAndAuthenticateUser(app)
+    const { token } = await createAndAuthenticateUser(app, true)
 
     const user = await prisma.user.findFirstOrThrow()
 
diff --git a/src/http/controllers/gyms/create.spec.ts b/src/http/controllers/gyms/create.spec.ts
@@ -13,7 +13,7 @@ describe('Create Gym (e2e)', () => {
   })
 
   it('should be able to create a gym', async () => {
-    const { token } = await createAndAuthenticateUser(app)
+    const { token } = await createAndAuthenticateUser(app, true)
 
     const response = await request(app.server)
       .post('/gyms')
diff --git a/src/http/controllers/gyms/nearby.spec.ts b/src/http/controllers/gyms/nearby.spec.ts
@@ -13,7 +13,7 @@ describe('Nearby Gyms (e2e)', () => {
   })
 
   it('should be able to list nearby gyms', async () => {
-    const { token } = await createAndAuthenticateUser(app)
+    const { token } = await createAndAuthenticateUser(app, true)
 
     await request(app.server)
       .post('/gyms')
diff --git a/src/http/controllers/gyms/routes.ts b/src/http/controllers/gyms/routes.ts
@@ -1,6 +1,7 @@
 import { verifyJwt } from '@/http/middlewares/verify-jwt'
 import { FastifyInstance } from 'fastify'
 
+import { verifyUserRole } from '@/http/middlewares/verify-user-role'
 import { create } from './create'
 import { nearby } from './nearby'
 import { search } from './search'
@@ -11,5 +12,5 @@ export async function gymsRoutes(app: FastifyInstance) {
   app.get('/gyms/search', search)
   app.get('/gyms/nearby', nearby)
 
-  app.post('/gyms', create)
+  app.post('/gyms', { onRequest: [verifyUserRole('ADMIN')] }, create)
 }
diff --git a/src/http/controllers/gyms/search.spec.ts b/src/http/controllers/gyms/search.spec.ts
@@ -13,7 +13,7 @@ describe('Search Gyms (e2e)', () => {
   })
 
   it('should be able to search gyms by title', async () => {
-    const { token } = await createAndAuthenticateUser(app)
+    const { token } = await createAndAuthenticateUser(app, true)
 
     await request(app.server)
       .post('/gyms')
diff --git a/src/http/controllers/users/authenticate.ts b/src/http/controllers/users/authenticate.ts
@@ -23,17 +23,39 @@ export async function authenticate(
     })
 
     const token = await reply.jwtSign(
-      {},
+      {
+        role: user.role,
+      },
       {
         sign: {
           sub: user.id,
         },
       },
     )
 
-    return reply.status(200).send({
-      token,
-    })
+    const refreshToken = await reply.jwtSign(
+      {
+        role: user.role,
+      },
+      {
+        sign: {
+          sub: user.id,
+          expiresIn: '7d',
+        },
+      },
+    )
+
+    return reply
+      .setCookie('refreshToken', refreshToken, {
+        path: '/',
+        secure: true,
+        sameSite: true,
+        httpOnly: true,
+      })
+      .status(200)
+      .send({
+        token,
+      })
   } catch (err) {
     if (err instanceof InvalidCredentialsError) {
       return reply.status(400).send({ message: err.message })
diff --git a/src/http/controllers/users/profile.spec.ts b/src/http/controllers/users/profile.spec.ts
@@ -13,7 +13,7 @@ describe('Profile (e2e)', () => {
   })
 
   it('should be able to get user profile', async () => {
-    const { token } = await createAndAuthenticateUser(app)
+    const { token } = await createAndAuthenticateUser(app, true)
 
     const profileResponse = await request(app.server)
       .get('/me')
diff --git a/src/http/controllers/users/refresh.spec.ts b/src/http/controllers/users/refresh.spec.ts
@@ -0,0 +1,41 @@
+import { app } from '@/app'
+import request from 'supertest'
+import { afterAll, beforeAll, describe, expect, it } from 'vitest'
+
+describe('Refresh (e2e)', () => {
+  beforeAll(async () => {
+    await app.ready()
+  })
+
+  afterAll(async () => {
+    await app.close()
+  })
+
+  it('should be able to refresh a token', async () => {
+    await request(app.server).post('/users').send({
+      name: 'John Doe',
+      email: 'johndoe@example.com',
+      password: '123456',
+    })
+
+    const authResponse = await request(app.server).post('/sessions').send({
+      email: 'johndoe@example.com',
+      password: '123456',
+    })
+
+    const cookies = authResponse.get('Set-Cookie') ?? []
+
+    const response = await request(app.server)
+      .patch('/token/refresh')
+      .set('Cookie', cookies)
+      .send()
+
+    expect(response.statusCode).toEqual(200)
+    expect(response.body).toEqual({
+      token: expect.any(String),
+    })
+    expect(response.get('Set-Cookie')).toEqual([
+      expect.stringContaining('refreshToken='),
+    ])
+  })
+})
diff --git a/src/http/controllers/users/refresh.ts b/src/http/controllers/users/refresh.ts
@@ -0,0 +1,38 @@
+import { FastifyReply, FastifyRequest } from 'fastify'
+
+export async function refresh(request: FastifyRequest, reply: FastifyReply) {
+  await request.jwtVerify({ onlyCookie: true })
+
+  const { role } = request.user
+
+  const token = await reply.jwtSign(
+    { role },
+    {
+      sign: {
+        sub: request.user.sub,
+      },
+    },
+  )
+
+  const refreshToken = await reply.jwtSign(
+    { role },
+    {
+      sign: {
+        sub: request.user.sub,
+        expiresIn: '7d',
+      },
+    },
+  )
+
+  return reply
+    .setCookie('refreshToken', refreshToken, {
+      path: '/',
+      secure: true,
+      sameSite: true,
+      httpOnly: true,
+    })
+    .status(200)
+    .send({
+      token,
+    })
+}
diff --git a/src/http/controllers/users/routes.ts b/src/http/controllers/users/routes.ts
@@ -2,12 +2,14 @@ import { verifyJwt } from '@/http/middlewares/verify-jwt'
 import { FastifyInstance } from 'fastify'
 import { authenticate } from './authenticate'
 import { profile } from './profile'
+import { refresh } from './refresh'
 import { register } from './register'
 
 export async function usersRoutes(app: FastifyInstance) {
   app.post('/users', register)
   app.post('/sessions', authenticate)
 
-  // Authenticated
+  app.patch('/token/refresh', refresh)
+
   app.get('/me', { onRequest: [verifyJwt] }, profile)
 }
diff --git a/src/http/middlewares/verify-user-role.ts b/src/http/middlewares/verify-user-role.ts
diff --git a/src/utils/test/create-and-authenticate-user.ts b/src/utils/test/create-and-authenticate-user.ts

Original file line number	Diff line number	Diff line change
`@@ -3,6 +3,7 @@ import '@fastify/jwt'`
`3`	`3`	`declare module '@fastify/jwt' {`
`4`	`4`	`export interface FastifyJWT {`
`5`	`5`	`user: {`
	`6`	`+ role: 'ADMIN' \| 'MEMBER'`
`6`	`7`	`sub: string`
`7`	`8`	`}`
`8`	`9`	`}`