Develop by AlvaroDavi5 · Pull Request #252 · AlvaroDavi5/Node_BackEnd_Boilerplate-TypeScript

AlvaroDavi5 · 2026-04-18T02:13:58Z

PROJ-TASK_ID

Task Link

Task Description

...

Checklist

Justification for unselected checkboxes:

...

Evidence

Logs Link

…s and responses

…and data masking

… safety

…ency

- @eslint/js from ^9.33.0 to ^9.39.4 - @sentry/cli from ^2.52.0 to ^2.58.5 - @types/multer from ^2.0.0 to ^2.1.0 - @types/node from ^24.3.3 to ^24.12.2 - @typescript-eslint/eslint-plugin from ^8.40.0 to ^8.58.1 - @typescript-eslint/parser from ^8.40.0 to ^8.58.1 - @typescript-eslint/scope-manager from ^8.40.0 to ^8.58.1 - @typescript-eslint/typescript-estree from ^8.40.0 to ^8.58.1 - @typescript-eslint/utils from ^8.40.0 to ^8.58.1 - eslint from ^9.33.0 to ^9.39.4 - eslint-plugin-jsdoc from ^54.1.1 to ^54.7.0 - globals from ^16.3.0 to ^16.5.0 - jest from ^30.0.5 to ^30.3.0 - jest-cli from ^30.0.5 to ^30.3.0 - lefthook from ^1.12.4 to ^1.13.6 - Updated other dependencies as necessary.

- Updated @fastify/static to ^9.1.1 - Updated @nestjs/apollo to ^13.2.5 - Updated @nestjs/common to ^11.1.19 - Updated @nestjs/config to ^4.0.4 - Updated @nestjs/core to ^11.1.19 - Updated @nestjs/graphql to ^13.2.5 - Updated @nestjs/platform-fastify to ^11.1.19 - Updated @nestjs/platform-socket.io to ^11.1.19 - Updated @nestjs/platform-ws to ^11.1.19 - Updated @nestjs/schedule to ^6.1.3 - Updated @nestjs/swagger to ^11.3.0 - Updated @nestjs/websockets to ^11.1.19 - Updated @swc/cli to ^0.8.1 - Updated @swc/helpers to ^0.5.21 - Updated axios to ^1.15.0 - Updated class-validator to ^0.14.4 - Updated cors to ^2.8.6 - Updated dotenv to ^17.2.4 - Updated fastify to ^5.8.5 - Updated multer to ^2.1.1 - Updated @nestjs/cli to ^11.0.21 - Updated @nestjs/testing to ^11.1.19 - Updated @semantic-release/commit-analyzer to ^13.0.1 - Updated @semantic-release/github to ^12.0.6 - Updated @semantic-release/release-notes-generator to ^14.1.0 - Updated @typescript-eslint/eslint-plugin to ^8.58.2 - Updated @typescript-eslint/parser to ^8.58.2 - Updated @typescript-eslint/scope-manager to ^8.58.2 - Updated @typescript-eslint/typescript-estree to ^8.58.2 - Updated @typescript-eslint/utils to ^8.58.2 - Updated semantic-release to ^25.0.3 - Updated sonarqube-scanner to ^4.3.6

…src directory

…ser use cases

…ssword handling and hashing

…user use case tests

AlvaroDavi5 · 2026-04-18T05:34:18Z

falta corrigir crons em imagem docker

…ctation in UserEntities

…ervice mock and enhance logging

github-actions · 2026-04-20T07:09:52Z

🎉 This PR is included in version 8.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀

Copilot

Pull request overview

This PR refactors request/response logging (moving request ID + masking responsibilities into an interceptor), hardens login behavior (generic “Invalid Credentials”), updates build/runtime paths to align with build/src/**, and bumps a number of dependencies/docs accordingly.

Changes:

Replace RequestMiddleware-based request logging with ResponseInterceptor + new masking utilities.
Update auth/login flow, password hashing helpers, and related unit/integration tests.
Align webpack/db/migration/runtime paths with build/src/** output and update OpenAPI artifacts.

Reviewed changes

Copilot reviewed 50 out of 51 changed files in this pull request and generated 8 comments.

Show a summary per file

File	Description
webpack.config.ts	Adjusts node externals import + build entry path.
package.json	Updates scripts to `build/src/**`, bumps deps, adds overrides.
src/modules/core/infra/database/db.config.ts	Updates migrations path to `build/src/**`.
src/modules/core/security/Cryptography.service.ts	Adds `hashWithSecret` helper and reorganizes helpers.
src/modules/common/utils/masks.util.ts	Introduces masking utilities for logs.
tests/unit/modules/common/utils/Masks.util.test.ts	Adds unit tests for new masking utilities.
src/modules/api/interceptors/Response.interceptor.ts	Adds request logging + masking + request-id/header logic.
src/shared/internal/interfaces/endpointInterface.ts	Removes `next`/NextFunction typing from endpoint interface.
src/modules/api/middlewares/Request.middleware.ts	Removes request middleware (request id, masking, request logging).
src/modules/api/guards/Auth.guard.ts	Refactors token parsing and request.user assignment.
src/modules/common/constants/RequestRateLimit.constants.ts	Adds block durations and updates comments.
src/modules/app/user/api/controllers/User.controller.ts	Updates throttling config import/params.
src/modules/app/user/usecases/LoginUser.usecase.ts	Adds delay + generic invalid-credentials handling + logger usage.
src/modules/app/user/services/User.service.ts	Adds email uniqueness check; changes password hashing/validation internals.
src/modules/app/user/usecases/CreateUser.usecase.ts	Updates `getById` calls to rely on default args.
src/modules/app/user/usecases/GetUser.usecase.ts	Updates `getById` calls to rely on default args.
src/modules/app/user/usecases/UpdateUser.usecase.ts	Updates `getById` calls to rely on default args.
src/modules/app/user/usecases/DeleteUser.usecase.ts	Updates `getById` calls to rely on default args.
src/modules/app/user/user.module.ts	Removes middleware wiring.
src/modules/app/subscription/subscription.module.ts	Removes middleware wiring.
src/modules/app/hook/hook.module.ts	Removes middleware wiring.
src/modules/app/file/file.module.ts	Removes middleware wiring.
src/modules/app/app.module.ts	Removes middleware wiring.
src/modules/events/events.module.ts	Removes middleware wiring.
src/modules/events/queue/handlers/EventsQueue.handler.ts	Switches to `hashWithSecret` for env secret hash derivation.
src/modules/domain/entities/User.entity.ts	Stops mutating `updatedAt` in setters; updates Swagger example.
src/modules/domain/entities/UserPreference.entity.ts	Stops mutating `updatedAt` in setters.
src/modules/domain/entities/Subscription.entity.ts	Stops mutating `updatedAt` in setters.
src/modules/app/user/api/dto/user/CreateUserInput.dto.ts	Updates Swagger examples.
src/modules/app/user/api/dto/user/LoginUserInput.dto.ts	Updates Swagger examples.
src/modules/app/user/api/dto/user/UpdateUserInput.dto.ts	Updates Swagger examples.
tests/unit/modules/domain/entities/UserEntities.test.ts	Updates `updatedAt` expectation.
tests/unit/modules/app/user/usecases/LoginUser.usecase.test.ts	Adapts to login behavior + new dependencies.
tests/unit/modules/app/user/usecases/CreateUser.usecase.test.ts	Updates mock expectations for `getById` signature usage.
tests/unit/modules/app/user/usecases/GetUser.usecase.test.ts	Updates mock expectations for `getById` signature usage.
tests/unit/modules/app/user/usecases/UpdateUser.usecase.test.ts	Updates agent user typing + `getById` expectations.
tests/unit/modules/app/user/usecases/DeleteUser.usecase.test.ts	Updates agent user typing + `getById` expectations.
tests/unit/modules/app/user/strategies/User.strategy.test.ts	Casts agent user objects to `UserAuthInterface`.
tests/integration/modules/app/user/services/User.service.test.ts	Adds repository mock method for `findOne`.
tests/integration/modules/app/user/api/controllers/User.controller.test.ts	Adds ConfigService mock + logger provider wiring.
tests/integration/modules/api/controllers/Health.controller.test.ts	Adds ConfigService mock + logger provider wiring.
tests/e2e/api/Health.controller.spec.ts	Updates expectations for `baseUrl` and body.
scripts/seed.ts	Updates seeded password hash (and adds plaintext comment).
eslint.config.ts	Renames imported TS eslint plugin variable; restructures config blocks.
infra/backstage/api.yml	Updates embedded OpenAPI content and version.
docs/swagger.yaml	Updates OpenAPI spec output and version.
.github/pull_request_template.md	Adds checklist item for env variables.
.github/skills/staged-security-review/SKILL.md	Removes eslint command snippet from instructions.
.github/prompts/create-usecase-with-tests.prompt.md	Updates unit-test guidance text.
.github/agents/nestjs-backend.agent.md	Fixes staged-security-review reference path.

Copilot · 2026-04-20T07:14:02Z

+			const foundedUser = await this.getByEmail(entity.getEmail());
+			if (foundedUser)
+				throw this.exceptions.conflict({
+					message: 'E-mail already in use!',
+				});
 			const createdUser = await this.userRepository.create(entity);


create() now throws a conflict exception when the email already exists, but the surrounding try/catch converts all errors via caughtError() into an INTERNAL (500) exception. That means clients will never receive the intended 409 for duplicate emails. Consider rethrowing HttpException/known Exceptions unchanged (or only wrapping actual repository errors), so the conflict status is preserved.

Copilot · 2026-04-20T07:14:02Z

+		const newHash = this.hashPassword(passwordToValidate, salt);

-		if (!this.isSameHash(hash, newHash))
+		const isSameHash = this.cryptographyService.compareBuffer(Buffer.from(hash), Buffer.from(newHash ?? ''));
+		if (!isSameHash)


compareBuffer() uses crypto.timingSafeEqual() which throws if the buffers have different lengths. Here newHash can be null (hashing failure) and becomes an empty string buffer, which will crash with a 500 instead of a clean auth failure. Add a length check before calling compareBuffer, and/or make compareBuffer return false when lengths differ.

Copilot · 2026-04-20T07:14:02Z

+	private hashPassword(plainTextPassword: string, salt: string): string | null {
+		return this.cryptographyService.hashWithSecret('sha256', 'utf8', 'base64url', plainTextPassword, salt);
 	}


Password hashing scheme appears to have changed from the previous salt + password + secret construction to password + secret + salt via hashWithSecret(...). If there are existing users in the database with hashes generated by the old scheme, they will no longer be able to authenticate. Consider supporting both formats during verification (try legacy first, then new and rehash on success), or provide a migration/forced reset plan.

Copilot · 2026-04-20T07:14:03Z

+		} catch (_error) {
+			throw this.exceptions.unauthorized({
+				message: 'Invalid Credentials',
+			});
+		}


The outer try/catch converts any error (including DB/network/internal errors) into unauthorized('Invalid Credentials'), which can mask real outages and makes debugging/monitoring harder. Consider only mapping expected auth failures to 401, while rethrowing (or logging + wrapping) unexpected errors as 5xx.

Copilot · 2026-04-20T07:14:03Z

-			clientId: user.getId(),
-		};
-		const token = this.cryptographyService.encodeJwt(userAuthToEncode, 'utf8', '1D');
+			const preference = await this.userPreferenceService.getByUserId(foundedUser.getId()).catch(() => null).catch(() => null);


getByUserId(...).catch(() => null).catch(() => null) has a duplicated .catch() and will silently swallow any error from the preference service. This makes it hard to detect real failures. Prefer a single catch with an explicit comment/metric, or handle only the expected 'not found' case.

Suggested change

const preference = await this.userPreferenceService.getByUserId(foundedUser.getId()).catch(() => null).catch(() => null);

const preference = await this.userPreferenceService.getByUserId(foundedUser.getId()).catch((error) => {

this.logger.error('Failed to load user preferences during login; continuing without preferences.', error);

return null;

});

Copilot · 2026-04-20T07:14:03Z

+		const [headerRequestId] = normalizeToArray<string | undefined>(headers['x-request-id']);
+		const requestId = headerRequestId ?? request?.id ?? uuidV4();
 		if (requestId) {
-			this.logger.setRequestId(requestId);
+			request.id = requestId;
 			response.header('x-request-id', requestId);
+			this.logger.setRequestId(requestId);
 		}


x-request-id is generated and added to the response inside this interceptor. Interceptors don't run for requests rejected by guards (e.g., missing/invalid auth), so those error responses won't include x-request-id and logs from guards/filters may not be correlated. Consider moving request-id generation/header to a middleware/Fastify hook (runs before guards) or ensure the exception filter/guard sets the header when rejecting.

Copilot · 2026-04-20T07:14:03Z

+      version: 8.0.1
      contact:
-        name: Álvaro Alves
+        name: Ãlvaro Alves


The contact name appears to have been re-encoded (Ã�lvaro Alves), which will render incorrectly in Backstage/OpenAPI consumers. Please restore the correct UTF-8 string (Álvaro Alves) and ensure the file is saved/committed with UTF-8 encoding.

Suggested change

name: Ã�lvaro Alves

name: Álvaro Alves

Copilot · 2026-04-20T07:14:04Z

+  version: 8.0.1
  contact:
-    name: Álvaro Alves
+    name: Ãlvaro Alves


The contact name appears to have been re-encoded (Ã�lvaro Alves), which will render incorrectly in Swagger/OpenAPI consumers. Please restore the correct UTF-8 string (Álvaro Alves) and ensure the file is saved/committed with UTF-8 encoding.

Suggested change

name: Ã�lvaro Alves

name: Álvaro Alves

github-actions Bot and others added 20 commits March 18, 2026 07:34

Auto merge main into develop [skip ci]

9a81882

fix: update path to staged security scanner documentation

abd6751

chore: update mocking instructions for unit tests in usecase prompt

73de6e8

chore: update example email and password in user DTOs and seed script

c620541

docs: updated API documentation

581291b

feat: add data masking utilities for sensitive information in request…

9397354

…s and responses

refactor: remove RequestMiddleware from app modules

68c4f83

feat: enhance AuthGuard and ResponseInterceptor for improved logging …

bae91a9

…and data masking

refactor: update user-related tests to use UserAuthInterface for type…

e374252

… safety

refactor: update request rate limit constants for clarity and consist…

2911c5f

…ency

refactor: remove unnecessary updatedAt assignments in entity setters

827a889

chore(deps): remove fs dependency due to security concerns

d67c472

chore(deps): update Apollo dependencies to latest versions

fcd1f9c

chore(deps): remove aws-sdk due to end-of-support

5dfeef5

fix(deps): update dependencies to solve code vulnerabilities

fd5d229

chore(deps): updated dependencies to latest patch versions

8309ba4

chore(deps): update @semantic-release/npm to version 13.1.5

7278901

chore: eslint configs adjusts

70cb28b

chore: add checklist item for env variables in PR template

92294a0

AlvaroDavi5 self-assigned this Apr 18, 2026

This was linked to issues Apr 18, 2026

Fix vulnerabilities #217

Closed

Improve password hash comparison for login and fix vulnerability that exposes whether the email is valid #251

Closed

AlvaroDavi5 added 6 commits April 18, 2026 00:16

chore: update production start script and webpack entry point to use …

abbd596

…src directory

fix: remove unnecessary parameter from userService.getById calls in u…

777180d

…ser use cases

refactor: simplify UserService and CryptographyService methods for pa…

b1d1277

…ssword handling and hashing

fix: update database command paths in package.json to use src directory

bba0e0b

test: remove unnecessary parameter from userService.getById calls in …

cbb6999

…user use case tests

refactor: enhance error handling and logging in LoginUser use case

4a75081

style(chore): update webpack-node-externals import style

52aee29

AlvaroDavi5 added 4 commits April 18, 2026 02:35

test: correct baseUrl in HealthController test and fix updatedAt expe…

4f5224f

…ctation in UserEntities

fix: correct migration path in dbConfig to reference src directory

8b9c463

refactor: replace CryptographyService UUID generation with uuid package

f99d456

test: update HealthController and UserController tests to use ConfigS…

61a3666

…ervice mock and enhance logging

AlvaroDavi5 added fix bugfix or corrections refactor code refactoration test tests alterations chore packages and configs changes build dependencies and build files alterations style code style and format changes feat new feature labels Apr 20, 2026

AlvaroDavi5 requested a review from Copilot April 20, 2026 07:07

Copilot started reviewing on behalf of AlvaroDavi5 April 20, 2026 07:07 View session

AlvaroDavi5 added docs documentation updates or corrections github_actions Pull requests that update GitHub Actions code labels Apr 20, 2026

AlvaroDavi5 merged commit 8f5f6f4 into main Apr 20, 2026
9 of 11 checks passed

github-actions Bot added the released label Apr 20, 2026

Copilot AI reviewed Apr 20, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Develop#252

Develop#252
AlvaroDavi5 merged 32 commits into
mainfrom
develop

AlvaroDavi5 commented Apr 18, 2026

Uh oh!

AlvaroDavi5 commented Apr 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

github-actions Bot commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Copilot AI Apr 20, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

-			const preference = await this.userPreferenceService.getByUserId(foundedUser.getId()).catch(() => null).catch(() => null);
+			const preference = await this.userPreferenceService.getByUserId(foundedUser.getId()).catch((error) => {
+				this.logger.error('Failed to load user preferences during login; continuing without preferences.', error);
+				return null;
+			});

Conversation

AlvaroDavi5 commented Apr 18, 2026

PROJ-TASK_ID

Task Description

Checklist

Justification for unselected checkboxes:

Evidence

Uh oh!

AlvaroDavi5 commented Apr 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Apr 20, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Apr 20, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

AlvaroDavi5 commented Apr 18, 2026 •

edited

Loading