[PB-267]: feat/add last passwordChangedAt middleware

src/lib/jwt.ts

@@ -41,3 +41,11 @@ export function verifyToken(token: string, secret: string) {
 export function verifyWithDefaultSecret(token: string) {
   return verify(token, getEnv().secrets.jwt);
 }
+
+export function getTokenDefaultIat() {
+  return Math.floor(Date.now() / 1000);
+}
+
+export function isTokenIatGreaterThanDate(date: Date, iat: number) {
+  return Math.floor(date.getTime() / 1000) < iat;
+}

src/modules/auth/jwt.strategy.spec.ts

@@ -0,0 +1,117 @@
+import { Test, TestingModule } from '@nestjs/testing';
+import { createMock } from '@golevelup/ts-jest';
+import { UserUseCases } from '../user/user.usecase';
+import { JwtStrategy } from './jwt.strategy';
+import { newUser } from '../../../test/fixtures';
+import { ConfigService } from '@nestjs/config';
+import { UnauthorizedException } from '@nestjs/common';
+import { getTokenDefaultIat } from '../../lib/jwt';
+
+describe('Jwt strategy', () => {
+  let userUseCases: UserUseCases;
+  let strategy: JwtStrategy;
+
+  beforeEach(async () => {
+    const moduleRef = await createTestingModule();
+    userUseCases = moduleRef.get<UserUseCases>(UserUseCases);
+    strategy = moduleRef.get<JwtStrategy>(JwtStrategy);
+  });
+
+  it('When token is old, then fail', async () => {
+    await expect(strategy.validate({ email: '[email protected]' })).rejects.toThrow(
+      new UnauthorizedException('Old token version detected'),
+    );
+  });
+
+  it('When user does not exist, then fail', async () => {
+    jest.spyOn(userUseCases, 'getUser').mockResolvedValue(null);
+
+    await expect(
+      strategy.validate({ payload: { uuid: 'anyUuid' } }),
+    ).rejects.toThrow(UnauthorizedException);
+  });
+
+  it('When token iat is older than lastPasswordChangedAt , then fail', async () => {
+    const user = newUser();
+    const greaterDate = new Date();
+    greaterDate.setMinutes(greaterDate.getMinutes() + 1);
+    user.lastPasswordChangedAt = greaterDate;
+    const tokenIat = getTokenDefaultIat();
+
+    jest.spyOn(userUseCases, 'getUser').mockResolvedValue(user);
+
+    await expect(
+      strategy.validate({ payload: { uuid: 'anyUuid' }, iat: tokenIat }),
+    ).rejects.toThrow(UnauthorizedException);
+  });
+
+  it('When user has lastPasswordChangedAt older than token iat, then return user', async () => {
+    const tokenIat = getTokenDefaultIat();
+    const user = newUser();
+    const olderDate = new Date();
+    olderDate.setMinutes(olderDate.getMinutes() - 1);
+    user.lastPasswordChangedAt = olderDate;
+
+    jest.spyOn(userUseCases, 'getUser').mockResolvedValue(user);
+
+    await expect(
+      strategy.validate({ payload: { uuid: 'anyUuid' }, iat: tokenIat }),
+    ).resolves.toBe(user);
+  });
+
+  it('When token has iat but user has not lastPasswordChangedAt, then return user', async () => {
+    const tokenIat = getTokenDefaultIat();
+    const user = newUser();
+    user.lastPasswordChangedAt = null;
+
+    jest.spyOn(userUseCases, 'getUser').mockResolvedValue(user);
+
+    await expect(
+      strategy.validate({ payload: { uuid: 'anyUuid' }, iat: tokenIat }),
+    ).resolves.toBe(user);
+  });
+
+  it('When user  is guest on shared workspace, then return owner', async () => {
+    const guestUser = newUser();
+    const owner = newUser();
+    const anyUuid = 'testUuid';
+    guestUser.bridgeUser = owner.username;
+    const olderDate = new Date();
+    olderDate.setMinutes(olderDate.getMinutes() - 1);
+    guestUser.lastPasswordChangedAt = olderDate;
+
+    const tokenIat = getTokenDefaultIat();
+
+    const getUserSpy = jest
+      .spyOn(userUseCases, 'getUser')
+      .mockResolvedValue(guestUser);
+
+    const getUserByUsernameSpy = jest
+      .spyOn(userUseCases, 'getUserByUsername')
+      .mockResolvedValue(owner);
+
+    await expect(
+      strategy.validate({ payload: { uuid: anyUuid }, iat: tokenIat }),
+    ).resolves.toBe(owner);
+
+    expect(getUserSpy).toHaveBeenCalledWith(anyUuid);
+    expect(getUserByUsernameSpy).toHaveBeenCalledWith(owner.username);
+  });
+});
+
+const createTestingModule = (): Promise<TestingModule> => {
+  return Test.createTestingModule({
+    controllers: [],
+    providers: [
+      {
+        provide: UserUseCases,
+        useValue: createMock<UserUseCases>(),
+      },
+      {
+        provide: ConfigService,
+        useValue: createMock<ConfigService>(),
+      },
+      JwtStrategy,
+    ],
+  }).compile();
+};

src/modules/auth/jwt.strategy.ts

@@ -9,6 +9,7 @@ import { PassportStrategy } from '@nestjs/passport';
 import { ExtractJwt, Strategy } from 'passport-jwt';
 import { User } from '../user/user.domain';
 import { UserUseCases } from '../user/user.usecase';
+import { isTokenIatGreaterThanDate } from '../../lib/jwt';
 
 export interface JwtPayload {
   email: string;
@@ -42,6 +43,23 @@ export class JwtStrategy extends PassportStrategy(Strategy, strategyId) {
         throw new UnauthorizedException();
       }
 
+      const userWithoutLastPasswordChangedAt =
+        user.lastPasswordChangedAt === null;
+
+      const tokenOlderThanLastPasswordChangedAt =
+        user.lastPasswordChangedAt &&
+        !isTokenIatGreaterThanDate(
+          new Date(user.lastPasswordChangedAt),
+          payload.iat,
+        );
+
+      if (
+        !userWithoutLastPasswordChangedAt &&
+        tokenOlderThanLastPasswordChangedAt
+      ) {
+        throw new UnauthorizedException();
+      }
+
       if (user.isGuestOnSharedWorkspace()) {
         return this.userUseCases.getUserByUsername(user.bridgeUser);
       }

src/modules/user/user.usecase.ts

@@ -58,6 +58,7 @@ import { AttemptChangeEmailHasExpiredException } from './exception/attempt-chang
 import { AttemptChangeEmailNotFoundException } from './exception/attempt-change-email-not-found.exception';
 import { UserEmailAlreadyInUseException } from './exception/user-email-already-in-use.exception';
 import { UserNotFoundException } from './exception/user-not-found.exception';
+import { getTokenDefaultIat } from '../../lib/jwt';
 
 class ReferralsNotAvailableError extends Error {
   constructor() {
@@ -533,6 +534,7 @@ export class UserUseCases {
           pass: userData.userId,
         },
       },
+      iat: getTokenDefaultIat(),
     };
   }