create-bubbles 0.1.23 → 0.1.24

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/auth.module.ts

@@ -0,0 +1,26 @@
+import { Module } from '@nestjs/common'
+import { APP_GUARD } from '@nestjs/core'
+import { AuthController } from './auth.controller'
+import { AuthRepository } from './auth.repository'
+import { AuthService } from './auth.service'
+import { SessionAuthGuard } from './guards/session-auth.guard'
+import { PasswordService } from './password.service'
+import { SessionStoreService } from './session/session-store.service'
+import { SessionTokenService } from './session/session-token.service'
+
+@Module({
+  controllers: [AuthController],
+  providers: [
+    AuthRepository,
+    AuthService,
+    PasswordService,
+    SessionTokenService,
+    SessionStoreService,
+    {
+      provide: APP_GUARD,
+      useClass: SessionAuthGuard,
+    },
+  ],
+  exports: [SessionStoreService],
+})
+export class AuthModule {}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/auth.repository.ts

@@ -0,0 +1,40 @@
+import { DRIZZLE, type DrizzleDB } from '@/database/db.module'
+import { users } from '@/database/schema'
+import { Inject, Injectable } from '@nestjs/common'
+import { eq } from 'drizzle-orm'
+
+type CreateUserInput = Pick<typeof users.$inferInsert, 'name' | 'account' | 'passwordHash'>
+
+@Injectable()
+export class AuthRepository {
+  constructor(@Inject(DRIZZLE) private readonly db: DrizzleDB) {}
+
+  async findByAccount(account: string) {
+    const [user] = await this.db.select().from(users).where(eq(users.account, account)).limit(1)
+    return user ?? null
+  }
+
+  async findPublicById(userId: string) {
+    const [user] = await this.db
+      .select({
+        id: users.id,
+        account: users.account,
+        name: users.name,
+        status: users.status,
+      })
+      .from(users)
+      .where(eq(users.id, userId))
+      .limit(1)
+    return user ?? null
+  }
+
+  async createUser(input: CreateUserInput) {
+    const [user] = await this.db
+      .insert(users)
+      .values(input)
+      // 处理账号重复情况 ，不插入重复账号
+      .onConflictDoNothing({ target: users.account })
+      .returning()
+    return user ?? null
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/auth.service.ts

@@ -0,0 +1,129 @@
+import { detectSessionTerminal } from '@/common/constants/session.constants'
+import { AppException } from '@/common/exceptions/app.exception'
+import { Injectable } from '@nestjs/common'
+import { ConfigService } from '@nestjs/config'
+import { AuthUser, LogoutResult, RegisterResult } from 'shared/types'
+import { normalizeAccount } from 'shared/utils'
+import { AUTH_ERRORS } from './auth.errors'
+import { AuthRepository } from './auth.repository'
+import { LoginDto } from './dto/login.dto'
+import { RegisterDto } from './dto/register.dto'
+import { PasswordService } from './password.service'
+import { SessionStoreService } from './session/session-store.service'
+import { SessionTokenService } from './session/session-token.service'
+
+interface LoginMetadata {
+  ip: string
+  userAgent: string
+}
+
+const LOGIN_DUMMY_PASSWORD_HASH =
+  '$argon2id$v=19$m=65536,p=4,t=3$/sDN9pcO6kkAcm+ncFtbdA$vmQIsQtUG9E+s22x70njKji67RJDseq12y/sYFG7iNk'
+
+@Injectable()
+export class AuthService {
+  private readonly idleExpiresIn: number
+
+  constructor(
+    private readonly authRepository: AuthRepository,
+    private readonly passwordService: PasswordService,
+    private readonly sessionTokenService: SessionTokenService,
+    private readonly sessionStoreService: SessionStoreService,
+    config: ConfigService,
+  ) {
+    this.idleExpiresIn = Math.floor(config.getOrThrow<number>('session.idleTtlMs') / 1000)
+  }
+
+  async register(input: RegisterDto): Promise<RegisterResult> {
+    const account = normalizeAccount(input.account)
+    const passwordHash = await this.useAuthInfrastrutrue(() =>
+      this.passwordService.hash(input.password),
+    )
+    const user = await this.useAuthInfrastrutrue(() =>
+      this.authRepository.createUser({
+        name: input.name.trim(),
+        account,
+        passwordHash,
+      }),
+    )
+    if (!user) {
+      throw new AppException(AUTH_ERRORS.ACCOUNT_ALREADY_EXISTS)
+    }
+
+    return {
+      id: user.id,
+      name: user.name,
+      account: user.account,
+    }
+  }
+
+  async login(input: LoginDto, metadata: LoginMetadata) {
+    const account = normalizeAccount(input.account)
+    const user = await this.useAuthInfrastrutrue(() => this.authRepository.findByAccount(account))
+    const passwordHash = user?.status === 'active' ? user.passwordHash : LOGIN_DUMMY_PASSWORD_HASH
+    const passwordMatches = await this.useAuthInfrastrutrue(() =>
+      this.passwordService.verify(passwordHash, input.password),
+    )
+
+    if (!user || user.status !== 'active' || !passwordMatches) {
+      throw new AppException(AUTH_ERRORS.INVALID_CREDENTIALS)
+    }
+
+    const { rawToken, tokenDigest } = this.sessionTokenService.createToken()
+
+    const session = await this.sessionStoreService.createOrReplace({
+      tokenDigest,
+      userId: user.id,
+      terminal: detectSessionTerminal(metadata.userAgent),
+      loginIp: metadata.ip.slice(0, 64),
+      userAgent: metadata.userAgent.slice(0, 500),
+    })
+
+    return {
+      accessToken: rawToken,
+      tokenType: 'Bearer' as const,
+      idleExpiresIn: this.idleExpiresIn,
+      absoluteExpiresAt: new Date(session.absoluteExpiresAtMs).toISOString(),
+    }
+  }
+
+  private async useAuthInfrastrutrue<T>(operation: () => Promise<T>): Promise<T> {
+    try {
+      return await operation()
+    } catch (cause: unknown) {
+      if (cause instanceof AppException) {
+        throw cause
+      }
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, { cause })
+    }
+  }
+
+  async getCurrentUser(userId: string): Promise<AuthUser> {
+    const user = await this.useAuthInfrastrutrue(() =>
+      this.authRepository.findPublicById(userId).catch((cause: unknown) => {
+        throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, { cause })
+      }),
+    )
+
+    if (!user || user.status !== 'active') {
+      throw new AppException(AUTH_ERRORS.SESSION_INVALID)
+    }
+
+    return {
+      id: user.id,
+      account: user.account,
+      name: user.name,
+    }
+  }
+
+  async logout(authorization: string | undefined): Promise<LogoutResult> {
+    const rawToken = this.sessionTokenService.extractBearerToken(authorization)
+    if (!rawToken) {
+      return { loggedOut: true }
+    }
+
+    const tokenDigest = this.sessionTokenService.digest(rawToken)
+    await this.sessionStoreService.logout(tokenDigest)
+    return { loggedOut: true }
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/dto/auth-repsponse.dto.ts

@@ -0,0 +1,31 @@
+import { createZodDto } from 'nestjs-zod'
+import z from 'zod'
+
+const authUserSchema = z.object({
+  id: z.string().uuid(),
+  account: z.string(),
+  name: z.string(),
+})
+
+export class RegisterResultDto extends createZodDto(authUserSchema) {}
+
+export class LoginResultDto extends createZodDto(
+  z.object({
+    accessToken: z.string().min(1),
+    tokenType: z.literal('Bearer'),
+    idleExpiresIn: z.number().int().positive(),
+    absoluteExpiresAt: z.string().datetime(),
+  }),
+) {}
+
+export class CurrentUserDto extends createZodDto(
+  authUserSchema.extend({
+    terminal: z.enum(['web', 'desktop', 'mobile']),
+  }),
+) {}
+
+export class LogoutResultDto extends createZodDto(
+  z.object({
+    loggedOut: z.literal(true),
+  }),
+) {}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/dto/login.dto.ts

@@ -0,0 +1,11 @@
+import { createZodDto } from 'nestjs-zod'
+import { LoginRequest } from 'shared/types'
+import { ACCOUNT_PATTERN } from 'shared/utils'
+import z from 'zod'
+
+export const loginSchema = z.object({
+  account: z.string().trim().min(4).max(32).regex(ACCOUNT_PATTERN, '账号格式错误'),
+  password: z.string().min(1).max(128),
+}) satisfies z.ZodType<LoginRequest>
+
+export class LoginDto extends createZodDto(loginSchema) {}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/dto/register.dto.ts

@@ -0,0 +1,17 @@
+import { createZodDto } from 'nestjs-zod'
+import { RegisterRequest } from 'shared/types'
+import { ACCOUNT_PATTERN } from 'shared/utils'
+import z from 'zod'
+
+export const registerSchema = z.object({
+  name: z.string().trim().min(2).max(100),
+  account: z
+    .string()
+    .trim()
+    .min(4)
+    .max(32)
+    .regex(ACCOUNT_PATTERN, '账号只能包含字母、数字和下划线'),
+  password: z.string().min(8).max(128),
+}) satisfies z.ZodType<RegisterRequest>
+
+export class RegisterDto extends createZodDto(registerSchema) {}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/guards/session-auth.guard.ts

@@ -0,0 +1,50 @@
+import { IS_PUBLIC_KEY } from '@/common/constants/auth'
+import { AppException } from '@/common/exceptions/app.exception'
+import { CanActivate, ExecutionContext, Injectable } from '@nestjs/common'
+import { Reflector } from '@nestjs/core'
+import { AUTH_ERRORS } from '../auth.errors'
+import { SessionStoreService } from '../session/session-store.service'
+import { SessionTokenService } from '../session/session-token.service'
+import { AuthenticatedRequest } from '../session/session.types'
+
+@Injectable()
+export class SessionAuthGuard implements CanActivate {
+  constructor(
+    private readonly reflector: Reflector,
+    private readonly sessionTokenService: SessionTokenService,
+    private readonly sessionStoreService: SessionStoreService,
+  ) {}
+
+  async canActivate(context: ExecutionContext) {
+    const request = context.switchToHttp().getRequest<AuthenticatedRequest>()
+
+    // Cors 预检不携带业务 token , 也不会执行 Controller
+    if (request.method === 'OPTIONS') {
+      return true
+    }
+
+    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
+      context.getHandler(),
+      context.getClass(),
+    ])
+
+    if (isPublic) {
+      return true
+    }
+
+    const rawToken = this.sessionTokenService.extractBearerToken(request.headers.authorization)
+
+    if (!rawToken) {
+      throw new AppException(AUTH_ERRORS.SESSION_TOKEN_MISSING)
+    }
+
+    const tokenDigest = this.sessionTokenService.digest(rawToken)
+    const auth = await this.sessionStoreService.validateAndTouch(tokenDigest)
+
+    if (!auth) {
+      throw new AppException(AUTH_ERRORS.SESSION_INVALID)
+    }
+    request.auth = auth
+    return true
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/password.service.ts

@@ -0,0 +1,24 @@
+import { Injectable } from '@nestjs/common'
+import * as argon2 from 'argon2'
+
+export const PASSWORD_HASH_OPTIONS = {
+  type: argon2.argon2id,
+  memoryCost: 65_536,
+  timeCost: 3,
+  parallelism: 4,
+} as const
+
+@Injectable()
+export class PasswordService {
+  hash(password: string) {
+    return argon2.hash(password, PASSWORD_HASH_OPTIONS)
+  }
+
+  async verify(passswordHash: string, password: string) {
+    try {
+      return await argon2.verify(passswordHash, password)
+    } catch {
+      return false
+    }
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/session/session-store.service.ts

@@ -0,0 +1,198 @@
+import {
+  createSessionKey,
+  createSessionSlotKey,
+  isSessionTerminal,
+  SESSION_KEY_PREFIX,
+  SESSION_SLOT_PREFIX,
+  SESSION_TERMINALS,
+} from '@/common/constants/session.constants'
+import { AppException } from '@/common/exceptions/app.exception'
+import { InjectRedis } from '@nestjs-modules/ioredis'
+import { Injectable } from '@nestjs/common'
+import { ConfigService } from '@nestjs/config'
+import Redis from 'ioredis'
+import { AUTH_ERRORS } from '../auth.errors'
+import {
+  CREATE_OR_REPLACE_SESSION_SCRIPT,
+  LOGOUT_SESSION_SCRIPT,
+  REVOKE_USER_SESSIONS_SCRIPT,
+  VALIDATE_AND_TOUCH_SESSION_SCRIPT,
+} from './session.script'
+import { CreatedSession, CreateSessionInput, CurrentAuthType } from './session.types'
+
+const INVALID_SESSION_CODES = new Set(['NOT_FOUND', 'REPLACED', 'ABSOLUTE_EXPIRED'])
+
+type SessionRedis = Redis & {
+  authCreateOrReplaceSession(...args: string[]): Promise<unknown>
+  authValidateAndTouchSession(...args: string[]): Promise<unknown>
+  authLogoutSession(...args: string[]): Promise<unknown>
+  authRevokeUserSessions(...args: string[]): Promise<unknown>
+}
+
+const SCRIPT_CODE_PATTERN = /^[A-Z][A-Z0-9_]{0,79}$/
+
+function createScriptProtocolError(operation: string, value: string | undefined): Error {
+  const code = SCRIPT_CODE_PATTERN.test(value ?? '') ? value : 'UNKNOWN'
+  return new Error(`Redis ${operation} script returned ${code}`)
+}
+
+@Injectable()
+export class SessionStoreService {
+  // private readonly logger = new Logger(SessionStoreService.name)
+  private readonly redis: SessionRedis
+  private readonly idleTtlMs: number
+  private readonly absoluteTtlMs: number
+
+  constructor(@InjectRedis() redis: Redis, config: ConfigService) {
+    this.redis = redis as SessionRedis
+    this.idleTtlMs = config.getOrThrow<number>('session.idleTtlMs')
+    this.absoluteTtlMs = config.getOrThrow<number>('session.absoluteTtlMs')
+
+    this.redis.defineCommand('authCreateOrReplaceSession', {
+      numberOfKeys: 2,
+      lua: CREATE_OR_REPLACE_SESSION_SCRIPT,
+    })
+
+    this.redis.defineCommand('authValidateAndTouchSession', {
+      numberOfKeys: 1,
+      lua: VALIDATE_AND_TOUCH_SESSION_SCRIPT,
+    })
+
+    this.redis.defineCommand('authLogoutSession', {
+      numberOfKeys: 1,
+      lua: LOGOUT_SESSION_SCRIPT,
+    })
+
+    this.redis.defineCommand('authRevokeUserSessions', {
+      numberOfKeys: SESSION_TERMINALS.length,
+      lua: REVOKE_USER_SESSIONS_SCRIPT,
+    })
+  }
+
+  private async execute(command: () => Promise<unknown>) {
+    try {
+      const result = await command()
+
+      if (!Array.isArray(result)) {
+        throw new Error('Redis script returned a non-array result')
+      }
+      return result.map((item) => String(item ?? ''))
+    } catch (cause: unknown) {
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, { cause })
+    }
+  }
+
+  async createOrReplace(input: CreateSessionInput): Promise<CreatedSession> {
+    const result = await this.execute(() =>
+      this.redis.authCreateOrReplaceSession(
+        createSessionSlotKey(input.userId, input.terminal),
+        createSessionKey(input.tokenDigest),
+        input.tokenDigest,
+        input.userId,
+        input.terminal,
+        String(this.idleTtlMs),
+        String(this.absoluteTtlMs),
+        input.loginIp,
+        input.userAgent,
+        SESSION_KEY_PREFIX,
+      ),
+    )
+
+    // if (result[0] !== '1') {
+    //   this.logger.error(`Create session script rejected: ${result[1] ?? 'UNKNOWN'}`)
+    //   throw new ServiceUnavailableException('暂时无法创建登录状态')
+    // }
+
+    const initialExpiresAtMs = Number(result[2])
+    const absoluteExpiresAtMs = Number(result[3])
+
+    // if (!Number.isFinite(initialExpiresAtMs) || !Number.isFinite(absoluteExpiresAtMs)) {
+    //   throw new ServiceUnavailableException('登录状态数据异常')
+    // }
+
+    return {
+      initialExpiresAtMs,
+      absoluteExpiresAtMs,
+    }
+  }
+
+  async validateAndTouch(tokenDigest: string): Promise<CurrentAuthType | null> {
+    const result = await this.execute(() =>
+      this.redis.authValidateAndTouchSession(
+        createSessionKey(tokenDigest),
+        tokenDigest,
+        SESSION_SLOT_PREFIX,
+        String(this.idleTtlMs),
+      ),
+    )
+
+    if (result[0] !== '1') {
+      const code = result[1] ?? 'UNKNOWN'
+
+      if (INVALID_SESSION_CODES.has(code)) {
+        return null
+      }
+
+      // this.logger.error(`Validate session script returned unexpected code: ${code}`)
+      // throw new ServiceUnavailableException('登录状态数据异常')
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, {
+        cause: createScriptProtocolError('validateAndTouch', result[1]),
+      })
+    }
+
+    const userId = result[1]
+    const terminal = result[2]
+
+    // if (!userId || !terminal || !isSessionTerminal(terminal)) {
+    //   this.logger.error('Redis returned an invalid Session payload')
+    //   throw new ServiceUnavailableException('登录状态数据异常')
+    // }
+
+    if (!userId || !terminal || !isSessionTerminal(terminal)) {
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, {
+        cause: createScriptProtocolError('validateAndTouch', result[1]),
+      })
+    }
+
+    return {
+      userId,
+      terminal,
+    }
+  }
+
+  async logout(tokenDigest: string) {
+    const result = await this.execute(() =>
+      this.redis.authLogoutSession(createSessionKey(tokenDigest), tokenDigest, SESSION_SLOT_PREFIX),
+    )
+
+    // if (result[0] !== '1') {
+    //   this.logger.error(`Logout session script returned unexpected code: ${result[1] ?? 'UNKNOWN'}`)
+    //   throw new ServiceUnavailableException('暂时无法完成退出')
+    // }
+
+    if (result[0] !== '1') {
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, {
+        cause: createScriptProtocolError('logout', result[1]),
+      })
+    }
+  }
+
+  async revokeAllForUser(userId: string) {
+    const slotKeys = SESSION_TERMINALS.map((terminal) => createSessionSlotKey(userId, terminal))
+    const result = await this.execute(() =>
+      this.redis.authRevokeUserSessions(...slotKeys, SESSION_KEY_PREFIX),
+    )
+    // if (result[0] !== '1') {
+    //   this.logger.error(
+    //     `Revoke user sessions script returned unexpected code: ${result[1] ?? 'UNKNOWN'}`,
+    //   )
+    //   throw new ServiceUnavailableException('暂时无法撤销用户登录状态')
+    // }
+
+    if (result[0] !== '1') {
+      throw new AppException(AUTH_ERRORS.SERVICE_UNAVAILABLE, {
+        cause: createScriptProtocolError('revokeAllForUser', result[1]),
+      })
+    }
+  }
+}

package/template-vp-monorepo-react-nestjs/apps/server/src/modules/auth/session/session-token.service.ts

@@ -0,0 +1,29 @@
+import { Injectable } from '@nestjs/common'
+import { ConfigService } from '@nestjs/config'
+import { createHmac, randomBytes } from 'node:crypto'
+
+@Injectable()
+export class SessionTokenService {
+  private readonly tokenPepper: string
+
+  constructor(config: ConfigService) {
+    this.tokenPepper = config.getOrThrow<string>('session.tokenPepper')
+  }
+
+  digest(rawToken: string) {
+    return createHmac('sha256', this.tokenPepper).update(rawToken).digest('hex')
+  }
+
+  createToken() {
+    const rawToken = randomBytes(32).toString('base64url')
+    return {
+      rawToken,
+      tokenDigest: this.digest(rawToken),
+    }
+  }
+
+  extractBearerToken(authorization: string | undefined) {
+    const matched = /^Bearer\s+([A-Za-z0-9_-]{43})$/.exec(authorization ?? '')
+    return matched?.[1] ?? null
+  }
+}