nestjs-oauth2-password

import { Module } from '@nestjs/common';
import { CredentialsModule, CredentialsService } from 'nestjs-credentials';
import { OAuth2PasswordModule } from 'nestjs-oauth2-password';
import { TokenStoreService } from './token-store.service';

@Module({
  imports: [
    CredentialsModule.register({ useFactory: () => userStore }), // user lookup + password verify
    OAuth2PasswordModule.forRootAsync({
      inject: [CredentialsService, TokenStoreService],
      useFactory: (creds: CredentialsService, tokens: TokenStoreService) => ({
        validateUser: (username, password) => creds.verify(username, password),
        tokenStore: tokens,
        accessTokenTtl: 60 * 60,           // 1h
        refreshTokenTtl: 60 * 60 * 24 * 14, // 14d
      }),
    }),
  ],
})
export class AppModule {}

import { Public, type AuthenticatedRequest } from 'nestjs-oauth2-password';

@Public()
@Get('health')
health() { return { ok: true }; }

@Get('me')
me(@Req() req: AuthenticatedRequest) {
  return req.user; // whatever your validateUser returned; req.client too
}

import { Injectable } from '@nestjs/common';
import {
  hashToken,
  type IssuedAccessToken,
  type StoredAccessToken,
  type TokenStore,
} from 'nestjs-oauth2-password';

@Injectable()
export class TokenStoreService implements TokenStore<User> {
  constructor(private readonly db: PrismaService) {}

  saveAccessToken(t: IssuedAccessToken<User>) {
    return this.db.accessToken.create({
      data: { tokenHash: hashToken(t.token), userId: t.user.id, expiryDate: t.expiryDate },
    });
  }

  async findAccessToken(token: string): Promise<StoredAccessToken<User> | null> {
    const row = await this.db.accessToken.findUnique({
      where: { tokenHash: hashToken(token) },
      include: { user: true },
    });
    return row ? { user: row.user, client: null, expiryDate: row.expiryDate } : null;
  }

  revokeAccessToken(token: string) {
    return this.db.accessToken.deleteMany({ where: { tokenHash: hashToken(token) } });
  }

  // …saveRefreshToken / findRefreshToken / revokeRefreshToken follow the same shape.
  // A refresh row stores the access token it was issued with, so rotation revokes both.
}

OAuth2PasswordModule.forRoot({
  validateUser: (username, password, client) => credentials.verify(username, password), // required
  tokenStore,                  // required
  clientStore,                 // required if requireClient/confidentialClients
  accessTokenTtl: 3600,        // seconds (default)
  refreshTokenTtl: 1209600,    // seconds (default — 14d)
  enableRefreshToken: true,    // issue refresh tokens (default)
  requireClient: false,        // require client_id on every grant (default)
  confidentialClients: false,  // verify client_secret — implies requireClient (default)
  tokenBytes: 32,              // entropy of generated opaque tokens (default — 256-bit)
  attachTo: 'user',            // request property the principal is attached to (default)
  registerGuard: true,         // register the bearer guard globally via APP_GUARD (default)
  registerController: true,    // mount /oauth/token + /oauth/revoke (default)
  isGlobal: true,              // module is global (default)
});

@UseGuards(OAuth2PasswordGuard)
@Controller('admin')
export class AdminController {}