Csrf protection

package.json

@@ -60,6 +60,7 @@
     "@opentelemetry/exporter-prometheus": "^0.203.0",
     "@opentelemetry/instrumentation": "^0.203.0",
     "@opentelemetry/sdk-node": "^0.203.0",
+    "@types/csurf": "^1.11.5",
     "@types/express-session": "^1.18.2",
     "@types/handlebars": "^4.0.40",
     "@types/multer": "^1.4.12",
@@ -76,6 +77,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.2",
     "connect-redis": "^9.0.0",
+    "csurf": "^1.11.0",
     "dataloader": "^2.2.3",
     "express": "^5.2.1",
     "express-session": "^1.19.0",
@@ -84,6 +86,7 @@
     "graphql": "^16.12.0",
     "graphql-subscriptions": "^3.0.0",
     "handlebars": "^4.7.8",
+    "helmet": "^8.0.0",
     "ioredis": "^5.9.3",
     "joi": "^17.13.3",
     "multer": "^2.0.1",
@@ -101,8 +104,7 @@
     "stripe": "^18.3.0",
     "swagger-ui-express": "^5.0.1",
     "typeorm": "^0.3.28",
-    "uuid": "^11.1.0",
-    "helmet": "^8.0.0"
+    "uuid": "^11.1.0"
   },
   "devDependencies": {
     "@commitlint/cli": "^19.0.0",

src/app.module.ts

@@ -51,6 +51,7 @@ import { CdnModule } from './cdn/cdn.module';
 import { AuthModule } from './auth/auth.module';
 import { PaymentsModule } from './payments/payments.module';
 import { LocalizationModule } from './localization/localization.module';
+import { CsrfModule } from './common/csrf/csrf.module';
 
 @Module({})
 export class AppModule {
@@ -128,6 +129,7 @@ export class AppModule {
       ApiVersioningModule,
       HealthModule,
       DatabaseModule,
+      CsrfModule,
     ];
 
     // Feature modules - conditionally loaded based on feature flags

src/assessment/entities/assessment.entity.ts

@@ -8,6 +8,10 @@ import {
   Entity,
   OneToMany,
   PrimaryGeneratedColumn,
+  Index,
+  DeleteDateColumn,
+  OneToMany,
+  PrimaryGeneratedColumn,
 } from 'typeorm';
 import { Question } from './question.entity';
 

src/assessment/entities/question.entity.ts

@@ -1,4 +1,4 @@
-import { ManyToOne, PrimaryGeneratedColumn, Index } from 'typeorm';
+import {  Entity, ManyToOne, PrimaryGeneratedColumn, Index } from 'typeorm';
 import { Column, DeleteDateColumn, Entity, ManyToOne, PrimaryGeneratedColumn } from 'typeorm';
 import { QuestionType } from '../enums/question-type.enum';
 import { Assessment } from './assessment.entity';

src/common/csrf/csrf.controller.ts

@@ -0,0 +1,56 @@
+import { Controller, Get, Post, UseGuards, Req, Res, HttpStatus, HttpCode } from '@nestjs/common';
+import { Request, Response } from 'express';
+import { ApiTags, ApiOperation, ApiResponse } from '@nestjs/swagger';
+import { JwtAuthGuard } from '../../auth/guards/jwt-auth.guard';
+import { CsrfService } from './csrf.service';
+
+@ApiTags('CSRF')
+@Controller('csrf')
+export class CsrfController {
+  constructor(private readonly csrfService: CsrfService) {}
+
+  @Get('token')
+  @UseGuards(JwtAuthGuard)
+  @ApiOperation({ summary: 'Get CSRF token' })
+  @ApiResponse({ status: 200, description: 'CSRF token generated successfully' })
+  getCsrfToken(@Req() req: Request, @Res() res: Response): void {
+    const sessionId = this.getSessionId(req);
+    const token = this.csrfService.generateToken(sessionId);
+
+    res.setHeader('X-CSRF-Token', token);
+    res.json({ csrfToken: token });
+  }
+
+  @Post('validate')
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Validate CSRF token' })
+  @ApiResponse({ status: 200, description: 'CSRF token is valid' })
+  @ApiResponse({ status: 400, description: 'Invalid CSRF token' })
+  validateCsrfToken(@Req() req: Request): { valid: boolean } {
+    const sessionId = this.getSessionId(req);
+    const token = req.body?.csrfToken || req.headers['x-csrf-token'];
+
+    const isValid = this.csrfService.validateToken(sessionId, token);
+    return { valid: isValid };
+  }
+
+  @Post('invalidate')
+  @UseGuards(JwtAuthGuard)
+  @HttpCode(HttpStatus.OK)
+  @ApiOperation({ summary: 'Invalidate CSRF token' })
+  @ApiResponse({ status: 200, description: 'CSRF token invalidated successfully' })
+  invalidateCsrfToken(@Req() req: Request): { message: string } {
+    const sessionId = this.getSessionId(req);
+    this.csrfService.invalidateToken(sessionId);
+
+    return { message: 'CSRF token invalidated successfully' };
+  }
+
+  private getSessionId(req: Request): string {
+    if ((req as any).session?.id) {
+      return (req as any).session.id;
+    }
+    return req.ip || req.connection.remoteAddress || 'unknown';
+  }
+}

src/common/csrf/csrf.module.ts

@@ -0,0 +1,15 @@
+import { Module, MiddlewareConsumer, RequestMethod } from '@nestjs/common';
+import { CsrfMiddleware } from '../middleware/csrf.middleware';
+import { CsrfService } from './csrf.service';
+import { CsrfController } from './csrf.controller';
+
+@Module({
+  providers: [CsrfService],
+  controllers: [CsrfController],
+  exports: [CsrfService],
+})
+export class CsrfModule {
+  configure(consumer: MiddlewareConsumer) {
+    consumer.apply(CsrfMiddleware).forRoutes({ path: '*', method: RequestMethod.ALL });
+  }
+}

src/common/csrf/csrf.service.ts

@@ -0,0 +1,54 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { v4 as uuidv4 } from 'uuid';
+
+@Injectable()
+export class CsrfService {
+  private readonly csrfTokens = new Map<string, { token: string; expires: number }>();
+  private readonly tokenExpiryTime: number;
+
+  constructor(private configService: ConfigService) {
+    this.tokenExpiryTime = this.configService.get<number>('CSRF_TOKEN_EXPIRY', 3600000); // 1 hour default
+  }
+
+  generateToken(sessionId: string): string {
+    const token = uuidv4();
+    const expires = Date.now() + this.tokenExpiryTime;
+
+    this.csrfTokens.set(sessionId, { token, expires });
+    return token;
+  }
+
+  validateToken(sessionId: string, token: string): boolean {
+    const storedToken = this.csrfTokens.get(sessionId);
+
+    if (!storedToken || storedToken.expires <= Date.now()) {
+      return false;
+    }
+
+    return storedToken.token === token;
+  }
+
+  invalidateToken(sessionId: string): void {
+    this.csrfTokens.delete(sessionId);
+  }
+
+  getToken(sessionId: string): string | null {
+    const storedToken = this.csrfTokens.get(sessionId);
+
+    if (!storedToken || storedToken.expires <= Date.now()) {
+      return null;
+    }
+
+    return storedToken.token;
+  }
+
+  cleanupExpiredTokens(): void {
+    const now = Date.now();
+    for (const [sessionId, tokenData] of this.csrfTokens.entries()) {
+      if (tokenData.expires <= now) {
+        this.csrfTokens.delete(sessionId);
+      }
+    }
+  }
+}