133 lines
4.2 KiB
TypeScript
133 lines
4.2 KiB
TypeScript
import { Injectable } from '@nestjs/common';
|
||
import { DatabaseService } from '../database/database.service';
|
||
import { PasswordHasher } from './password-hasher';
|
||
import type { AuthUser, RoleName, UserRecord } from './user.types';
|
||
|
||
interface UserRow {
|
||
id: string;
|
||
username: string;
|
||
email: string;
|
||
password_hash: string;
|
||
display_name: string;
|
||
role_name: RoleName;
|
||
is_active: boolean;
|
||
failed_login_attempts: number;
|
||
locked_until: Date | null;
|
||
last_login_at: Date | null;
|
||
created_at: Date;
|
||
updated_at: Date;
|
||
}
|
||
|
||
const USER_COLUMNS = `u.id, u.username, u.email, u.password_hash, u.display_name, r.name AS role_name,
|
||
u.is_active, u.failed_login_attempts, u.locked_until,
|
||
u.last_login_at, u.created_at, u.updated_at`;
|
||
|
||
/** Wandelt einen Datenbank-Datensatz in die öffentliche Benutzer-Repräsentation um. */
|
||
function toAuthUser(record: UserRecord): AuthUser {
|
||
return {
|
||
id: record.id,
|
||
username: record.username,
|
||
email: record.email,
|
||
displayName: record.displayName,
|
||
role: record.role,
|
||
};
|
||
}
|
||
|
||
/**
|
||
* Benutzer-Repository (Infrastructure): Alle Datenbankzugriffe für Benutzer.
|
||
* Enthält keine Business-Logik – nur Datenzugriff.
|
||
*/
|
||
@Injectable()
|
||
export class UserRepository {
|
||
constructor(
|
||
private readonly database: DatabaseService,
|
||
private readonly passwordHasher: PasswordHasher,
|
||
) {}
|
||
|
||
async findByUsername(username: string): Promise<UserRecord | null> {
|
||
const result = await this.database.query<UserRow>(
|
||
`SELECT ${USER_COLUMNS}
|
||
FROM users u JOIN roles r ON r.id = u.role_id
|
||
WHERE u.username = $1`,
|
||
[username],
|
||
);
|
||
return result.rows[0] ? this.mapRow(result.rows[0]) : null;
|
||
}
|
||
|
||
async findById(id: string): Promise<UserRecord | null> {
|
||
const result = await this.database.query<UserRow>(
|
||
`SELECT ${USER_COLUMNS}
|
||
FROM users u JOIN roles r ON r.id = u.role_id
|
||
WHERE u.id = $1`,
|
||
[id],
|
||
);
|
||
return result.rows[0] ? this.mapRow(result.rows[0]) : null;
|
||
}
|
||
|
||
async updateLoginSuccess(userId: string): Promise<void> {
|
||
await this.database.query(
|
||
`UPDATE users
|
||
SET last_login_at = now(),
|
||
failed_login_attempts = 0,
|
||
locked_until = NULL,
|
||
updated_at = now()
|
||
WHERE id = $1`,
|
||
[userId],
|
||
);
|
||
}
|
||
|
||
async updateLoginFailure(
|
||
userId: string,
|
||
attempts: number,
|
||
shouldLock: boolean,
|
||
lockoutMinutes: number,
|
||
): Promise<void> {
|
||
await this.database.query(
|
||
`UPDATE users
|
||
SET failed_login_attempts = $2,
|
||
locked_until = CASE WHEN $3::boolean
|
||
THEN now() + make_interval(mins => $4::int)
|
||
ELSE locked_until END,
|
||
updated_at = now()
|
||
WHERE id = $1`,
|
||
[userId, attempts, shouldLock, lockoutMinutes],
|
||
);
|
||
}
|
||
|
||
async create(input: {
|
||
username: string;
|
||
email: string;
|
||
password: string;
|
||
displayName: string;
|
||
role: RoleName;
|
||
}): Promise<AuthUser> {
|
||
const passwordHash = await this.passwordHasher.hash(input.password);
|
||
const result = await this.database.query<UserRow>(
|
||
`INSERT INTO users (username, email, password_hash, display_name, role_id)
|
||
VALUES ($1, $2, $3, $4, (SELECT id FROM roles WHERE name = $5))
|
||
RETURNING id, username, email, display_name,
|
||
(SELECT name FROM roles WHERE id = role_id) AS role_name,
|
||
true AS is_active, 0 AS failed_login_attempts, NULL::timestamptz AS locked_until,
|
||
NULL::timestamptz AS last_login_at, now() AS created_at, now() AS updated_at`,
|
||
[input.username, input.email, passwordHash, input.displayName, input.role],
|
||
);
|
||
return toAuthUser(this.mapRow(result.rows[0]));
|
||
}
|
||
|
||
private mapRow(row: UserRow): UserRecord {
|
||
return {
|
||
id: row.id,
|
||
username: row.username,
|
||
email: row.email,
|
||
passwordHash: row.password_hash,
|
||
displayName: row.display_name,
|
||
role: row.role_name,
|
||
isActive: row.is_active,
|
||
failedLoginAttempts: row.failed_login_attempts,
|
||
lockedUntil: row.locked_until,
|
||
lastLoginAt: row.last_login_at,
|
||
createdAt: row.created_at,
|
||
updatedAt: row.updated_at,
|
||
};
|
||
}
|
||
} |