auth.middleware.ts

import {
	BadRequestException,
	HttpException,
	Injectable,
	InternalServerErrorException,
	NestMiddleware,
	UnauthorizedException,
} from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import Sentry from '@sentry/minimal';
import { Response } from 'express';
import jwt from 'jsonwebtoken';
import { Repository } from 'typeorm';
import { LogOutEntity } from '../entities/log-out/log-out.entity.js';
import { JwtScopesEnum } from '../entities/user/enums/jwt-scopes.enum.js';
import { UserEntity } from '../entities/user/user.entity.js';
import { Messages } from '../exceptions/text/messages.js';
import { Constants } from '../helpers/constants/constants.js';
import { isObjectEmpty } from '../helpers/index.js';
import { IRequestWithCognitoInfo } from './cognito-decoded.interface.js';

@Injectable()
export class AuthMiddleware implements NestMiddleware {
	public constructor(
		@InjectRepository(UserEntity)
		private readonly userRepository: Repository<UserEntity>,
		@InjectRepository(LogOutEntity)
		private readonly logOutRepository: Repository<LogOutEntity>,
	) {}
	async use(req: IRequestWithCognitoInfo, _res: Response, next: (err?: any, res?: any) => void): Promise<void> {
		let token: string;
		try {
			token = req.cookies[Constants.JWT_COOKIE_KEY_NAME];
		} catch (_e) {
			if (process.env.NODE_ENV !== 'test') {
				throw new UnauthorizedException('JWT verification failed');
			}
		}

		if (!token) {
			throw new UnauthorizedException('Token is missing');
		}

		const isLoggedOut = !!(await this.logOutRepository.findOne({ where: { jwtToken: token } }));
		if (isLoggedOut) {
			throw new UnauthorizedException('Token is invalid');
		}

		try {
			const jwtSecret = process.env.JWT_SECRET;
			const data = jwt.verify(token, jwtSecret) as jwt.JwtPayload;
			const userId = data.id;

			if (!userId) {
				throw new UnauthorizedException('JWT verification failed');
			}

			const userExists = await this.userRepository.findOne({ where: { id: userId } });
			if (!userExists) {
				throw new UnauthorizedException('JWT verification failed');
			}

			if (userExists.suspended) {
				throw new UnauthorizedException(Messages.ACCOUNT_SUSPENDED);
			}

			const addedScope: Array<JwtScopesEnum> = data.scope;
			if (addedScope && addedScope.length > 0) {
				if (addedScope.includes(JwtScopesEnum.TWO_FA_ENABLE)) {
					throw new BadRequestException(Messages.TWO_FA_REQUIRED);
				}
			}

			const payload = {
				sub: userId,
				email: data.email,
				exp: data.exp,
				iat: data.iat,
			};
			if (!payload || isObjectEmpty(payload)) {
				throw new UnauthorizedException('JWT verification failed');
			}
			req.decoded = payload;
			next();
		} catch (e) {
			Sentry.captureException(e);
			if (e instanceof HttpException || e instanceof UnauthorizedException) {
				throw e;
			}
			throw new InternalServerErrorException(Messages.AUTHORIZATION_REJECTED);
		}
	}
}