@dangao/bun-server 1.0.1 → 1.0.3

package/src/auth/oauth2.ts

@@ -0,0 +1,244 @@
+import { JWTUtil } from './jwt';
+import type {
+  OAuth2Client,
+  OAuth2AuthorizationRequest,
+  OAuth2TokenRequest,
+  OAuth2TokenResponse,
+  OAuth2CodeConfig,
+  JWTPayload,
+  UserInfo,
+} from './types';
+
+/**
+ * 授权码存储
+ */
+interface AuthorizationCode {
+  code: string;
+  clientId: string;
+  redirectUri: string;
+  userId: string;
+  scope?: string;
+  expiresAt: number;
+}
+
+/**
+ * OAuth2 服务
+ */
+export class OAuth2Service {
+  private readonly jwtUtil: JWTUtil;
+  private readonly clients: Map<string, OAuth2Client>;
+  private readonly codes: Map<string, AuthorizationCode>;
+  private readonly codeConfig: Required<OAuth2CodeConfig>;
+  private readonly userProvider?: (userId: string) => Promise<UserInfo | null>;
+
+  public constructor(
+    jwtUtil: JWTUtil,
+    clients: OAuth2Client[] = [],
+    codeConfig: OAuth2CodeConfig = {},
+    userProvider?: (userId: string) => Promise<UserInfo | null>,
+  ) {
+    this.jwtUtil = jwtUtil;
+    this.clients = new Map();
+    this.codes = new Map();
+    this.codeConfig = {
+      expiresIn: codeConfig.expiresIn ?? 600,
+      length: codeConfig.length ?? 32,
+    };
+
+    // 注册客户端
+    for (const client of clients) {
+      this.clients.set(client.clientId, client);
+    }
+
+    this.userProvider = userProvider;
+
+    // 定期清理过期的授权码
+    setInterval(() => this.cleanupExpiredCodes(), 60000);
+  }
+
+  /**
+   * 注册客户端
+   */
+  public registerClient(client: OAuth2Client): void {
+    this.clients.set(client.clientId, client);
+  }
+
+  /**
+   * 验证授权请求
+   */
+  public validateAuthorizationRequest(
+    request: OAuth2AuthorizationRequest,
+  ): { valid: boolean; error?: string } {
+    const client = this.clients.get(request.clientId);
+    if (!client) {
+      return { valid: false, error: 'invalid_client' };
+    }
+
+    if (request.responseType !== 'code') {
+      return { valid: false, error: 'unsupported_response_type' };
+    }
+
+    if (!client.redirectUris.includes(request.redirectUri)) {
+      return { valid: false, error: 'invalid_redirect_uri' };
+    }
+
+    return { valid: true };
+  }
+
+  /**
+   * 生成授权码
+   */
+  public generateAuthorizationCode(
+    clientId: string,
+    redirectUri: string,
+    userId: string,
+    scope?: string,
+  ): string {
+    const code = this.generateRandomString(this.codeConfig.length);
+    const expiresAt = Date.now() + this.codeConfig.expiresIn * 1000;
+
+    this.codes.set(code, {
+      code,
+      clientId,
+      redirectUri,
+      userId,
+      scope,
+      expiresAt,
+    });
+
+    return code;
+  }
+
+  /**
+   * 交换授权码获取令牌
+   */
+  public async exchangeCodeForToken(
+    request: OAuth2TokenRequest,
+  ): Promise<OAuth2TokenResponse | null> {
+    if (request.grantType !== 'authorization_code') {
+      return null;
+    }
+
+    const codeData = this.codes.get(request.code);
+    if (!codeData) {
+      return null;
+    }
+
+    // 验证授权码是否过期
+    if (codeData.expiresAt < Date.now()) {
+      this.codes.delete(request.code);
+      return null;
+    }
+
+    // 验证客户端
+    const client = this.clients.get(request.clientId);
+    if (!client || client.clientSecret !== request.clientSecret) {
+      return null;
+    }
+
+    // 验证重定向 URI
+    if (codeData.redirectUri !== request.redirectUri) {
+      return null;
+    }
+
+    // 删除已使用的授权码
+    this.codes.delete(request.code);
+
+    // 获取用户信息
+    let userInfo: UserInfo | null = null;
+    if (this.userProvider) {
+      userInfo = await this.userProvider(codeData.userId);
+    }
+
+    if (!userInfo) {
+      userInfo = {
+        id: codeData.userId,
+        username: codeData.userId,
+      };
+    }
+
+    // 生成令牌
+    const payload: Omit<JWTPayload, 'exp' | 'iat'> = {
+      sub: userInfo.id,
+      username: userInfo.username,
+      roles: userInfo.roles,
+    };
+
+    const accessToken = this.jwtUtil.generateAccessToken(payload);
+    const refreshToken = this.jwtUtil.generateRefreshToken(payload);
+
+    return {
+      accessToken,
+      tokenType: 'Bearer',
+      expiresIn: this.jwtUtil['config'].accessTokenExpiresIn,
+      refreshToken,
+      scope: codeData.scope,
+    };
+  }
+
+  /**
+   * 刷新令牌
+   */
+  public async refreshToken(refreshToken: string): Promise<OAuth2TokenResponse | null> {
+    const payload = this.jwtUtil.verify(refreshToken);
+    if (!payload || !payload.sub) {
+      return null;
+    }
+
+    // 获取用户信息
+    let userInfo: UserInfo | null = null;
+    if (this.userProvider) {
+      userInfo = await this.userProvider(payload.sub);
+    }
+
+    if (!userInfo) {
+      userInfo = {
+        id: payload.sub,
+        username: payload.username as string || payload.sub,
+        roles: payload.roles as string[],
+      };
+    }
+
+    // 生成新令牌
+    const newPayload: Omit<JWTPayload, 'exp' | 'iat'> = {
+      sub: userInfo.id,
+      username: userInfo.username,
+      roles: userInfo.roles,
+    };
+
+    const accessToken = this.jwtUtil.generateAccessToken(newPayload);
+    const newRefreshToken = this.jwtUtil.generateRefreshToken(newPayload);
+
+    return {
+      accessToken,
+      tokenType: 'Bearer',
+      expiresIn: this.jwtUtil['config'].accessTokenExpiresIn,
+      refreshToken: newRefreshToken,
+    };
+  }
+
+  /**
+   * 生成随机字符串
+   */
+  private generateRandomString(length: number): string {
+    const chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789';
+    let result = '';
+    for (let i = 0; i < length; i++) {
+      result += chars.charAt(Math.floor(Math.random() * chars.length));
+    }
+    return result;
+  }
+
+  /**
+   * 清理过期的授权码
+   */
+  private cleanupExpiredCodes(): void {
+    const now = Date.now();
+    for (const [code, data] of this.codes.entries()) {
+      if (data.expiresAt < now) {
+        this.codes.delete(code);
+      }
+    }
+  }
+}
+

package/src/auth/types.ts

@@ -0,0 +1,248 @@
+/**
+ * 认证相关类型定义
+ */
+
+/**
+ * JWT 载荷
+ */
+export interface JWTPayload {
+  /**
+   * 用户 ID
+   */
+  sub: string;
+  /**
+   * 用户名
+   */
+  username?: string;
+  /**
+   * 角色列表
+   */
+  roles?: string[];
+  /**
+   * 过期时间（Unix 时间戳）
+   */
+  exp?: number;
+  /**
+   * 签发时间（Unix 时间戳）
+   */
+  iat?: number;
+  /**
+   * 其他自定义字段
+   */
+  [key: string]: unknown;
+}
+
+/**
+ * JWT 配置
+ */
+export interface JWTConfig {
+  /**
+   * 密钥（用于签名和验证）
+   */
+  secret: string;
+  /**
+   * 访问令牌过期时间（秒）
+   * @default 3600 (1 hour)
+   */
+  accessTokenExpiresIn?: number;
+  /**
+   * 刷新令牌过期时间（秒）
+   * @default 86400 * 7 (7 days)
+   */
+  refreshTokenExpiresIn?: number;
+  /**
+   * 算法
+   * @default 'HS256'
+   */
+  algorithm?: 'HS256' | 'HS384' | 'HS512';
+}
+
+/**
+ * OAuth2 授权码配置
+ */
+export interface OAuth2CodeConfig {
+  /**
+   * 授权码过期时间（秒）
+   * @default 600 (10 minutes)
+   */
+  expiresIn?: number;
+  /**
+   * 授权码长度
+   * @default 32
+   */
+  length?: number;
+}
+
+/**
+ * OAuth2 客户端配置
+ */
+export interface OAuth2Client {
+  /**
+   * 客户端 ID
+   */
+  clientId: string;
+  /**
+   * 客户端密钥
+   */
+  clientSecret: string;
+  /**
+   * 重定向 URI 列表
+   */
+  redirectUris: string[];
+  /**
+   * 允许的授权类型
+   */
+  grantTypes: ('authorization_code' | 'refresh_token')[];
+}
+
+/**
+ * OAuth2 授权请求
+ */
+export interface OAuth2AuthorizationRequest {
+  /**
+   * 客户端 ID
+   */
+  clientId: string;
+  /**
+   * 重定向 URI
+   */
+  redirectUri: string;
+  /**
+   * 响应类型
+   */
+  responseType: 'code';
+  /**
+   * 作用域（可选）
+   */
+  scope?: string;
+  /**
+   * 状态（用于 CSRF 防护）
+   */
+  state?: string;
+}
+
+/**
+ * OAuth2 令牌请求
+ */
+export interface OAuth2TokenRequest {
+  /**
+   * 授权码
+   */
+  code: string;
+  /**
+   * 客户端 ID
+   */
+  clientId: string;
+  /**
+   * 客户端密钥
+   */
+  clientSecret: string;
+  /**
+   * 重定向 URI
+   */
+  redirectUri: string;
+  /**
+   * 授权类型
+   */
+  grantType: 'authorization_code' | 'refresh_token';
+  /**
+   * 刷新令牌（用于 refresh_token 授权类型）
+   */
+  refreshToken?: string;
+}
+
+/**
+ * OAuth2 令牌响应
+ */
+export interface OAuth2TokenResponse {
+  /**
+   * 访问令牌
+   */
+  accessToken: string;
+  /**
+   * 令牌类型
+   */
+  tokenType: 'Bearer';
+  /**
+   * 过期时间（秒）
+   */
+  expiresIn: number;
+  /**
+   * 刷新令牌
+   */
+  refreshToken?: string;
+  /**
+   * 作用域
+   */
+  scope?: string;
+}
+
+/**
+ * 认证模块配置（已废弃，请使用 SecurityModuleConfig）
+ * @deprecated 使用 SecurityModule.forRoot() 替代
+ */
+export interface AuthModuleOptions {
+  /**
+   * JWT 配置
+   */
+  jwt: JWTConfig;
+  /**
+   * OAuth2 客户端列表
+   */
+  clients?: OAuth2Client[];
+  /**
+   * 授权码配置
+   */
+  codeConfig?: OAuth2CodeConfig;
+  /**
+   * 是否启用 OAuth2 端点
+   * @default true
+   */
+  enableOAuth2Endpoints?: boolean;
+  /**
+   * OAuth2 端点前缀
+   * @default '/oauth2'
+   */
+  oauth2Prefix?: string;
+}
+
+/**
+ * 用户信息
+ */
+export interface UserInfo {
+  /**
+   * 用户 ID
+   */
+  id: string;
+  /**
+   * 用户名
+   */
+  username: string;
+  /**
+   * 角色列表
+   */
+  roles?: string[];
+  /**
+   * 其他属性
+   */
+  [key: string]: unknown;
+}
+
+/**
+ * 认证上下文（附加到 Context）
+ */
+export interface AuthContext {
+  /**
+   * 用户信息
+   */
+  user?: UserInfo;
+  /**
+   * JWT 载荷
+   */
+  payload?: JWTPayload;
+  /**
+   * 是否已认证
+   */
+  isAuthenticated: boolean;
+}
+

package/src/cache/cache-module.ts

@@ -0,0 +1,67 @@
+import { Module, MODULE_METADATA_KEY, type ModuleProvider } from '../di/module';
+
+import { CacheService } from './service';
+import {
+  CACHE_OPTIONS_TOKEN,
+  CACHE_SERVICE_TOKEN,
+  MemoryCacheStore,
+  type CacheModuleOptions,
+  type CacheStore,
+} from './types';
+
+@Module({
+  providers: [],
+})
+export class CacheModule {
+  /**
+   * 创建缓存模块
+   * @param options - 模块配置
+   */
+  public static forRoot(
+    options: CacheModuleOptions = {},
+  ): typeof CacheModule {
+    const providers: ModuleProvider[] = [];
+
+    // 如果没有提供 store，使用默认的内存存储
+    const store: CacheStore =
+      options.store ??
+      new MemoryCacheStore({
+        cleanupInterval: 60000, // 每分钟清理一次
+      });
+
+    const service = new CacheService({
+      store,
+      defaultTtl: options.defaultTtl,
+      keyPrefix: options.keyPrefix,
+    });
+
+    providers.push(
+      {
+        provide: CACHE_SERVICE_TOKEN,
+        useValue: service,
+      },
+      {
+        provide: CACHE_OPTIONS_TOKEN,
+        useValue: options,
+      },
+      CacheService,
+    );
+
+    // 动态更新模块元数据
+    const existingMetadata =
+      Reflect.getMetadata(MODULE_METADATA_KEY, CacheModule) || {};
+    const metadata = {
+      ...existingMetadata,
+      providers: [...(existingMetadata.providers || []), ...providers],
+      exports: [
+        ...(existingMetadata.exports || []),
+        CACHE_SERVICE_TOKEN,
+        CACHE_OPTIONS_TOKEN,
+        CacheService,
+      ],
+    };
+    Reflect.defineMetadata(MODULE_METADATA_KEY, metadata, CacheModule);
+
+    return CacheModule;
+  }
+}