Merge pull request #1045 from Vox-d-glitch/issue-974-jwt-token-issuance

Add configurable JWT access token issuance

Author: nafiuishaaq

backend/src/auth/auth.module.ts

@@ -1,28 +1,25 @@
 import { Module } from '@nestjs/common';
 import { JwtModule } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
-import { ConfigModule, ConfigService } from '@nestjs/config';
 import { AuthController } from './auth.controller.js';
 import { AuthService } from './auth.service.js';
 import { JwtStrategy } from './strategies/jwt.strategy.js';
 import { WalletStrategy } from './strategies/wallet.strategy.js';
 import { JwtAuthGuard } from './guards/jwt-auth.guard.js';
 import { RolesGuard } from './guards/roles.guard.js';
+import { jwtModuleConfig } from '../config/jwt.config.js';
 import { UsersModule } from '../users/users.module.js';
 
+/**
+ * #971: Self-contained Auth module.
+ *
+ * Exports guards and strategies for use in other modules.
+ * Handles wallet authentication, JWT lifecycle, session management, and RBAC.
+ */
 @Module({
   imports: [
     PassportModule.register({ defaultStrategy: 'jwt' }),
-    JwtModule.registerAsync({
-      imports: [ConfigModule],
-      useFactory: (configService: ConfigService) => ({
-        secret: configService.get('JWT_SECRET', 'dev-secret'),
-        signOptions: {
-          expiresIn: configService.get('JWT_ACCESS_TTL', '900'),
-        },
-      }),
-      inject: [ConfigService],
-    }),
+    JwtModule.registerAsync(jwtModuleConfig),
     UsersModule,
   ],
   controllers: [AuthController],

backend/src/auth/auth.service.ts

@@ -6,6 +6,7 @@ import { JwtAccessTokenPayload } from './interfaces/jwt-payload.interface.js';
 import { WalletStrategy } from './strategies/wallet.strategy.js';
 import { UsersService } from '../users/users.service.js';
 import { AuthRole } from '../common/enums/auth-role.enum.js';
+import { ROLE_PERMISSIONS } from '../common/constants/role-permissions.constant.js';
 
 /**
  * #971-978: Auth service handling wallet login, JWT lifecycle, and session management.
@@ -125,6 +126,7 @@ export class AuthService {
     const roles = user.roles?.length
       ? user.roles.map((role) => role.name)
       : [AuthRole.MENTEE];
+    const permissions = this.resolvePermissions(roles);
 
     const accessPayload: JwtAccessTokenPayload = {
       sub: user.id,
@@ -133,6 +135,7 @@ export class AuthService {
       iat: Math.floor(Date.now() / 1000),
       exp: Math.floor(Date.now() / 1000) + accessTtl,
       roles,
+      permissions,
       status: user.status,
     };
 
@@ -222,11 +225,17 @@ export class AuthService {
     // In production: persist to database via UsersService
   }
 
-  private resolveRoles(walletAddress: string): Promise<string[]> {
-    // In production: query from database, keyed by walletAddress
-    // Default role for all authenticated users
-    void walletAddress;
-    return Promise.resolve(['MENTEE']);
+  /**
+   * #974: Resolve the union of permissions granted by a set of roles.
+   */
+  private resolvePermissions(roles: AuthRole[]): string[] {
+    const permissions = new Set<string>();
+    for (const role of roles) {
+      for (const permission of ROLE_PERMISSIONS[role] ?? []) {
+        permissions.add(permission);
+      }
+    }
+    return Array.from(permissions);
   }
 
   private cleanExpiredNonces(): void {

backend/src/auth/guards/jwt-auth.guard.ts

@@ -7,7 +7,7 @@ import {
 import { ConfigService } from '@nestjs/config';
 import { JwtService } from '@nestjs/jwt';
 import { Request } from 'express';
-import { JwtAccessTokenPayload } from '../interfaces/jwt-payload.interface';
+import { JwtAccessTokenPayload } from '../interfaces/jwt-payload.interface.js';
 import { UserStatus } from '../../users/enums/user-status.enum.js';
 
 /**

backend/src/auth/interfaces/jwt-payload.interface.ts

@@ -7,5 +7,6 @@ export interface JwtAccessTokenPayload {
   iat: number;
   exp: number;
   roles?: string[];
+  permissions?: string[];
   status: UserStatus;
 }

backend/src/auth/strategies/jwt.strategy.ts

@@ -29,6 +29,7 @@ export class JwtStrategy extends PassportStrategy(Strategy) {
       iat: payload.iat,
       exp: payload.exp,
       roles: payload.roles || [],
+      permissions: payload.permissions || [],
       status: payload.status,
     };
   }

backend/src/common/constants/role-permissions.constant.ts

@@ -0,0 +1,15 @@
+import { AuthRole } from '../enums/auth-role.enum.js';
+import { Permission } from '../enums/permission.enum.js';
+
+export const ROLE_PERMISSIONS: Record<AuthRole, Permission[]> = {
+  [AuthRole.USER]: [Permission.PROFILE_READ],
+  [AuthRole.MENTEE]: [Permission.PROFILE_READ, Permission.MENTEE_PROFILE_WRITE],
+  [AuthRole.MENTOR]: [Permission.PROFILE_READ, Permission.MENTOR_PROFILE_WRITE],
+  [AuthRole.ADMIN]: [
+    Permission.PROFILE_READ,
+    Permission.PROFILE_WRITE,
+    Permission.MENTOR_PROFILE_WRITE,
+    Permission.MENTEE_PROFILE_WRITE,
+    Permission.USER_MANAGE,
+  ],
+};

backend/src/common/enums/permission.enum.ts

@@ -0,0 +1,7 @@
+export enum Permission {
+  PROFILE_READ = 'profile:read',
+  PROFILE_WRITE = 'profile:write',
+  MENTOR_PROFILE_WRITE = 'mentor_profile:write',
+  MENTEE_PROFILE_WRITE = 'mentee_profile:write',
+  USER_MANAGE = 'user:manage',
+}

backend/src/config/jwt.config.ts

@@ -0,0 +1,26 @@
+import { ConfigModule, ConfigService } from '@nestjs/config';
+import { JwtModuleOptions } from '@nestjs/jwt';
+import { Algorithm } from 'jsonwebtoken';
+
+export const jwtModuleConfig = {
+  imports: [ConfigModule],
+  inject: [ConfigService],
+  useFactory: (config: ConfigService): JwtModuleOptions => {
+    const algorithm = config.get<Algorithm>('JWT_ALGORITHM', 'HS256');
+
+    if (algorithm === 'RS256') {
+      return {
+        privateKey: config.get<string>('JWT_PRIVATE_KEY'),
+        publicKey: config.get<string>('JWT_PUBLIC_KEY'),
+        signOptions: { algorithm },
+        verifyOptions: { algorithms: [algorithm] },
+      };
+    }
+
+    return {
+      secret: config.get<string>('JWT_SECRET', 'dev-secret'),
+      signOptions: { algorithm },
+      verifyOptions: { algorithms: [algorithm] },
+    };
+  },
+};

backend/src/users/users.controller.ts

@@ -129,6 +129,8 @@ export class UsersController {
       dto.username,
     );
     return UserResponseDto.fromEntity(user);
+  }
+
   @Get('admin/completeness')
   @UseGuards(RolesGuard)
   @Roles(AuthRole.ADMIN)

backend/src/users/users.module.ts

@@ -1,7 +1,7 @@
 import { Module } from '@nestjs/common';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { JwtModule } from '@nestjs/jwt';
-import { ConfigModule, ConfigService } from '@nestjs/config';
+import { ConfigModule } from '@nestjs/config';
 import { UsersController } from './users.controller.js';
 import { ProfilesController } from './profiles.controller.js';
 import { UsersService } from './users.service.js';
@@ -14,6 +14,7 @@ import { MenteeProfile } from './entities/mentee-profile.entity.js';
 import { PortfolioLink } from './entities/portfolio-link.entity.js';
 import { JwtAuthGuard } from '../auth/guards/jwt-auth.guard.js';
 import { RolesGuard } from '../auth/guards/roles.guard.js';
+import { jwtModuleConfig } from '../config/jwt.config.js';
 import { StorageModule } from '../storage/storage.module.js';
 import { AvailabilityModule } from '../availability/availability.module.js';
 import { ProfileCompletenessService } from './profile-completeness.service.js';
@@ -27,22 +28,12 @@ import { ProfileCompletenessService } from './profile-completeness.service.js';
       MenteeProfile,
       PortfolioLink,
     ]),
-    JwtModule.registerAsync({
-      imports: [ConfigModule],
-      inject: [ConfigService],
-      useFactory: (config: ConfigService) => ({
-        secret: config.get<string>('JWT_SECRET'),
-        signOptions: { expiresIn: '1h' },
-      }),
-    }),
+    JwtModule.registerAsync(jwtModuleConfig),
     ConfigModule,
     StorageModule,
     AvailabilityModule,
   ],
   controllers: [UsersController, ProfilesController, AvatarController],
-  providers: [UsersService, JwtAuthGuard, RolesGuard],
-  exports: [UsersService],
-  controllers: [UsersController],
   providers: [
     UsersService,
     JwtAuthGuard,