create-pardx-scaffold 0.1.0

package/template/apps/api/libs/domain/auth/src/guards/streaming-asr-session.guard.ts

@@ -0,0 +1,179 @@
+/**
+ * @fileoverview Streaming ASR Session Guard
+ *
+ * 专用于流式语音识别的 Session Token 验证守卫
+ *
+ * 解决问题：
+ * - 长时间录音场景下，JWT token refresh 导致音频数据丢失
+ * - 每次音频发送都需要验证 JWT token，性能开销大
+ *
+ * 方案：
+ * - 创建会话时生成长期有效的 session token (4小时)
+ * - 音频发送使用 session token 而不是 JWT token
+ * - Session token 与 session 生命周期绑定
+ *
+ * @module auth/guards/streaming-asr-session
+ */
+
+import {
+  Injectable,
+  CanActivate,
+  ExecutionContext,
+  Inject,
+  forwardRef,
+} from '@nestjs/common';
+import { JwtService } from '@nestjs/jwt';
+import { ConfigService } from '@nestjs/config';
+import { FastifyRequest } from 'fastify';
+import { apiError } from '@/filter/exception/api.exception';
+import { ApiErrorCode, CommonErrorCode } from '@repo/contracts/errors';
+import { StreamingAsrService } from '@app/shared-services/streaming-asr';
+import type { JwtConfig } from '@/config/validation';
+
+/**
+ * Session Token Payload
+ */
+interface SessionTokenPayload {
+  /** Session ID */
+  sessionId: string;
+  /** User ID */
+  userId: string;
+  /** Token 类型标识 */
+  type: 'streaming-asr-session';
+  /** 签发时间 */
+  iat: number;
+  /** 过期时间 */
+  exp: number;
+}
+
+/**
+ * Streaming ASR Session Guard
+ *
+ * @description
+ * 验证流式语音识别的 session token，确保：
+ * 1. Token 有效且未过期
+ * 2. Token 类型为 streaming-asr-session
+ * 3. Session 存在且状态有效
+ * 4. 将用户信息注入到 request 中
+ *
+ * @example
+ * ```typescript
+ * @UseGuards(StreamingAsrSessionGuard)
+ * @Post('/streaming-asr/sessions/:sessionId/audio')
+ * async sendAudioChunk(@Req() req: any) {
+ *   // req.userId, req.sessionId 已注入
+ * }
+ * ```
+ */
+@Injectable()
+export class StreamingAsrSessionGuard implements CanActivate {
+  constructor(
+    private readonly jwt: JwtService,
+    private readonly config: ConfigService,
+    @Inject(forwardRef(() => StreamingAsrService))
+    private readonly streamingAsrService: StreamingAsrService,
+  ) {}
+
+  /**
+   * 验证 session token
+   */
+  async canActivate(context: ExecutionContext): Promise<boolean> {
+    const request = context.switchToHttp().getRequest<FastifyRequest>();
+
+    // 1. 提取 session token
+    const sessionToken = this.extractSessionToken(request);
+    if (!sessionToken) {
+      throw apiError(CommonErrorCode.UnAuthorized, {
+        message: 'Session token is required',
+      });
+    }
+
+    // 2. 验证 token 签名和有效期
+    let payload: SessionTokenPayload;
+    try {
+      const jwtConfig = this.config.getOrThrow<JwtConfig>('jwt');
+      payload = await this.jwt.verifyAsync<SessionTokenPayload>(sessionToken, {
+        secret: jwtConfig.secret,
+      });
+    } catch (error) {
+      throw apiError(CommonErrorCode.UnAuthorized, {
+        message: 'Invalid or expired session token',
+      });
+    }
+
+    // 3. 验证 token 类型
+    if (payload.type !== 'streaming-asr-session') {
+      throw apiError(CommonErrorCode.UnAuthorized, {
+        message: 'Invalid token type',
+      });
+    }
+
+    // 4. 验证 session 是否存在且有效
+    try {
+      const session = await this.streamingAsrService.getSessionStatus(
+        payload.sessionId,
+      );
+
+      // Session 不存在或已失效
+      if (!session) {
+        throw apiError(CommonErrorCode.SessionExpired as ApiErrorCode, {
+          message: 'Session not found',
+        });
+      }
+
+      // ⚠️ 重要：允许 disconnected 状态继续，因为：
+      // 1. Provider 的 sendAudio 方法会自动处理 disconnected 状态的重连
+      // 2. 可能是 WebSocket 短暂断开，不应该立即拒绝请求
+      // 3. 只有在明确错误状态时才拒绝
+      if (session.status === 'error') {
+        throw apiError(CommonErrorCode.SessionExpired as ApiErrorCode, {
+          message: 'Session has encountered an error',
+        });
+      }
+
+      // disconnected 状态允许继续，让 sendAudio 尝试恢复连接
+      // completed 状态也允许继续（可能用户还在发送数据）
+    } catch (error) {
+      // Session 不存在
+      if ((error as any).status === 404) {
+        throw apiError(CommonErrorCode.SessionExpired as ApiErrorCode, {
+          message: 'Session not found',
+        });
+      }
+      throw error;
+    }
+
+    // 5. 注入用户信息到 request
+    (request as any).userId = payload.userId;
+    (request as any).sessionId = payload.sessionId;
+
+    return true;
+  }
+
+  /**
+   * 从 request 中提取 session token
+   *
+   * 支持两种方式：
+   * 1. Header: X-Session-Token
+   * 2. Query: session_token (用于 SSE)
+   */
+  private extractSessionToken(request: FastifyRequest): string | null {
+    // 优先从 header 获取
+    const headerToken = request.headers['x-session-token'] as
+      | string
+      | undefined;
+    if (headerToken) {
+      return headerToken;
+    }
+
+    // 从 query 获取（用于 SSE）
+    const queryToken = (request.query as any)?.session_token as
+      | string
+      | undefined;
+    if (queryToken) {
+      return decodeURIComponent(queryToken);
+    }
+
+    return null;
+  }
+}

package/template/apps/api/libs/domain/auth/src/index.ts

@@ -0,0 +1,12 @@
+export * from './auth.module';
+export * from './auth.service';
+export * from './auth-validation.service';
+export * from './auth.guard';
+export * from './auth';
+export * from './dto/auth.dto';
+// RBAC exports
+export * from './decorators/rbac.decorator';
+export * from './decorators/presets.decorator'; // 新增：预设装饰器
+export * from './decorators/resource-owner.decorator'; // 新增：资源所有者装饰器
+export * from './guards/streaming-asr-session.guard'; // 新增：流式识别会话守卫
+export * from './types/auth.interface';

package/template/apps/api/libs/domain/auth/src/types/auth.interface.ts

@@ -0,0 +1,52 @@
+import { FastifyRequest } from 'fastify';
+import { z } from 'zod';
+
+/**
+ * 认证上下文 Schema
+ */
+export const AuthContextSchema = z.object({
+  userId: z.string(),
+  isAdmin: z.boolean().optional(),
+  isAnonymity: z.boolean().optional(),
+  openid: z.string().optional(),
+});
+
+export type AuthContext = z.infer<typeof AuthContextSchema>;
+
+/**
+ * 用户信息 Schema（从 JWT 解析）
+ */
+export const AuthUserInfoSchema = z.object({
+  id: z.string(),
+  nickname: z.string().optional(),
+  code: z.string().optional(),
+  headerImg: z.string().optional(),
+  sex: z.string().optional(),
+  planExpireAt: z.string().optional(),
+  isAdmin: z.boolean(),
+  isAnonymity: z.boolean(),
+  openid: z.string().optional(),
+});
+
+export type AuthUserInfo = z.infer<typeof AuthUserInfoSchema>;
+
+/**
+ * 认证请求接口
+ * 扩展 FastifyRequest，包含认证相关的信息
+ *
+ * 由 AuthGuard 设置的字段:
+ * - userId: 用户ID
+ * - isAdmin: 是否为管理员
+ * - isAnonymity: 是否为匿名用户
+ * - openid: 用户openid
+ * - uid: 用户ID (别名)
+ * - userInfo: 用户信息
+ */
+export interface AuthenticatedRequest extends FastifyRequest {
+  userId: string;
+  isAdmin: boolean;
+  isAnonymity: boolean;
+  openid?: string;
+  uid: string;
+  userInfo: AuthUserInfo;
+}

package/template/apps/api/libs/domain/auth/tsconfig.lib.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.json",
+  "compilerOptions": {
+    "declaration": true,
+    "outDir": "../../dist/libs/auth"
+  },
+  "include": ["src/**/*"],
+  "exclude": ["node_modules", "dist", "test", "**/*spec.ts"]
+}

package/template/apps/api/libs/domain/db/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "@pardx/db",
+  "version": "0.0.1",
+  "main": "src/index.ts",
+  "types": "src/index.ts",
+  "private": true,
+  "scripts": {
+    "build": "tsc -p tsconfig.lib.json",
+    "lint": "eslint \"src/**/*.ts\" --fix"
+  }
+}

package/template/apps/api/libs/domain/db/src/index.ts

@@ -0,0 +1,14 @@
+// 新用户系统模块
+export * from './modules/user-info';
+export * from './modules/email-auth';
+export * from './modules/mobile-auth';
+export * from './modules/system-task-queue';
+export * from './modules/file-source';
+export * from './modules/country-code';
+
+// Message 模块
+export * from './modules/message';
+export * from './modules/wechat-auth';
+export * from './modules/google-auth';
+export * from './modules/discord-auth';
+export * from './modules/risk-detection-record';

package/template/apps/api/libs/domain/db/src/modules/country-code/country-code.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { PrismaModule } from '@app/prisma';
+import { CountryCodeService } from './country-code.service';
+import { RedisModule } from '@app/redis';
+import { ConfigModule } from '@nestjs/config';
+
+@Module({
+  imports: [PrismaModule, RedisModule, ConfigModule],
+  providers: [CountryCodeService],
+  exports: [CountryCodeService],
+})
+export class CountryCodeModule {}

package/template/apps/api/libs/domain/db/src/modules/country-code/country-code.service.ts

@@ -0,0 +1,140 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '@app/prisma';
+import { TransactionalServiceBase } from '@app/shared-db';
+import { HandlePrismaError, DbOperationType } from '@/utils/prisma-error.util';
+import { AppConfig } from '@/config/validation';
+import type { Prisma, CountryCode } from '@prisma/client';
+import { PardxApp } from '@/config/dto/config.dto';
+
+@Injectable()
+export class CountryCodeService extends TransactionalServiceBase {
+  private appConfig: AppConfig;
+
+  constructor(
+    prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {
+    super(prisma);
+    this.appConfig = config.getOrThrow<AppConfig>('app');
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async get(
+    where: Prisma.CountryCodeWhereUniqueInput,
+    additional?: {
+      select?: Prisma.CountryCodeSelect;
+    },
+  ): Promise<CountryCode | null> {
+    return this.getReadClient().countryCode.findUnique({
+      where,
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async list(
+    where: Prisma.CountryCodeWhereInput,
+    pagination?: {
+      orderBy?: Prisma.CountryCodeOrderByWithRelationInput;
+      limit?: number;
+      page?: number;
+    },
+    additional?: {
+      select?: Prisma.CountryCodeSelect;
+    },
+  ) {
+    const {
+      orderBy = { continent: 'asc' },
+      limit = this.appConfig.MaxPageSize,
+      page = 1,
+    } = pagination || {};
+    const skip = (page - 1) * limit;
+
+    const [list, total] = await Promise.all([
+      this.getReadClient().countryCode.findMany({
+        where: { ...where, isDeleted: false },
+        orderBy,
+        take: limit,
+        skip,
+        ...additional,
+      }),
+      this.getReadClient().countryCode.count({
+        where: { ...where, isDeleted: false },
+      }),
+    ]);
+
+    return { list, total, page, limit };
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async findByCode(code: string): Promise<CountryCode | null> {
+    return this.getReadClient().countryCode.findFirst({
+      where: { code, isDeleted: false },
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async findByContinent(continent: string): Promise<CountryCode[]> {
+    return this.getReadClient().countryCode.findMany({
+      where: { continent, isDeleted: false },
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.CREATE)
+  async create(
+    data: Prisma.CountryCodeCreateInput,
+    additional?: {
+      select?: Prisma.CountryCodeSelect;
+    },
+  ): Promise<CountryCode> {
+    return this.getWriteClient().countryCode.create({
+      data,
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.UPDATE)
+  async update(
+    where: Prisma.CountryCodeWhereUniqueInput,
+    data: Prisma.CountryCodeUpdateInput,
+    additional?: {
+      select?: Prisma.CountryCodeSelect;
+    },
+  ): Promise<CountryCode> {
+    return this.getWriteClient().countryCode.update({
+      where,
+      data,
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.DELETE)
+  async delete(
+    where: Prisma.CountryCodeWhereUniqueInput,
+  ): Promise<CountryCode> {
+    return this.getWriteClient().countryCode.delete({ where });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async loadRelations(): Promise<PardxApp.CountryReation> {
+    const countryCodes = await this.getReadClient().countryCode.findMany({
+      orderBy: { continent: 'asc' },
+    });
+
+    const relations: PardxApp.CountryReation = {
+      us: [],
+      eu: [],
+      ap: [],
+      cn: [],
+    };
+
+    for (const countryCode of countryCodes) {
+      const continent = countryCode.continent as keyof PardxApp.CountryReation;
+      if (relations[continent]) {
+        relations[continent].push(countryCode.code);
+      }
+    }
+    return relations;
+  }
+}

package/template/apps/api/libs/domain/db/src/modules/country-code/index.ts

@@ -0,0 +1,2 @@
+export * from './country-code.service';
+export * from './country-code.module';

package/template/apps/api/libs/domain/db/src/modules/discord-auth/discord-auth.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { DiscordAuthService } from './discord-auth.service';
+import { PrismaModule } from '@app/prisma';
+import { RedisModule } from '@app/redis';
+import { ConfigModule } from '@nestjs/config';
+
+@Module({
+  imports: [PrismaModule, RedisModule, ConfigModule],
+  providers: [DiscordAuthService],
+  exports: [DiscordAuthService],
+})
+export class DiscordAuthModule {}

package/template/apps/api/libs/domain/db/src/modules/discord-auth/discord-auth.service.ts

@@ -0,0 +1,101 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '@app/prisma';
+import { TransactionalServiceBase } from '@app/shared-db';
+import { HandlePrismaError, DbOperationType } from '@/utils/prisma-error.util';
+import { AppConfig } from '@/config/validation';
+import type { Prisma, DiscordAuth } from '@prisma/client';
+
+@Injectable()
+export class DiscordAuthService extends TransactionalServiceBase {
+  private appConfig: AppConfig;
+
+  constructor(
+    prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {
+    super(prisma);
+    this.appConfig = config.getOrThrow<AppConfig>('app');
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async get(
+    where: Prisma.DiscordAuthWhereInput,
+    additional?: { select?: Prisma.DiscordAuthSelect },
+  ): Promise<DiscordAuth | null> {
+    return this.getReadClient().discordAuth.findFirst({
+      where: { ...where, isDeleted: false },
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async getById(
+    id: string,
+    additional?: { select?: Prisma.DiscordAuthSelect },
+  ): Promise<DiscordAuth | null> {
+    return this.getReadClient().discordAuth.findUnique({
+      where: { discordId: id, isDeleted: false },
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async list(
+    where: Prisma.DiscordAuthWhereInput,
+    pagination?: {
+      orderBy?: Prisma.DiscordAuthOrderByWithRelationInput;
+      limit?: number;
+      page?: number;
+    },
+    additional?: { select?: Prisma.DiscordAuthSelect },
+  ): Promise<{ list: DiscordAuth[]; total: number; page: number; limit: number }> {
+    const {
+      orderBy = { createdAt: 'desc' },
+      limit = this.appConfig.MaxPageSize,
+      page = 1,
+    } = pagination || {};
+    const skip = (page - 1) * limit;
+
+    const [list, total] = await Promise.all([
+      this.getReadClient().discordAuth.findMany({
+        where: { ...where, isDeleted: false },
+        orderBy,
+        take: limit,
+        skip,
+        ...additional,
+      }),
+      this.getReadClient().discordAuth.count({
+        where: { ...where, isDeleted: false },
+      }),
+    ]);
+
+    return { list, total, page, limit };
+  }
+
+  @HandlePrismaError(DbOperationType.CREATE)
+  async create(
+    data: Prisma.DiscordAuthCreateInput,
+    additional?: { select?: Prisma.DiscordAuthSelect },
+  ): Promise<DiscordAuth> {
+    return this.getWriteClient().discordAuth.create({ data, ...additional });
+  }
+
+  @HandlePrismaError(DbOperationType.UPDATE)
+  async update(
+    where: Prisma.DiscordAuthWhereUniqueInput,
+    data: Prisma.DiscordAuthUpdateInput,
+    additional?: { select?: Prisma.DiscordAuthSelect },
+  ): Promise<DiscordAuth> {
+    return this.getWriteClient().discordAuth.update({
+      where,
+      data,
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.DELETE)
+  async delete(where: Prisma.DiscordAuthWhereUniqueInput): Promise<DiscordAuth> {
+    return this.getWriteClient().discordAuth.delete({ where });
+  }
+}

package/template/apps/api/libs/domain/db/src/modules/discord-auth/index.ts

@@ -0,0 +1,2 @@
+export * from './discord-auth.service';
+export * from './discord-auth.module';

package/template/apps/api/libs/domain/db/src/modules/email-auth/email-auth.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { EmailAuthService } from './email-auth.service';
+import { PrismaModule } from '@app/prisma';
+import { RedisModule } from '@app/redis';
+import { ConfigModule } from '@nestjs/config';
+
+@Module({
+  imports: [PrismaModule, RedisModule, ConfigModule],
+  providers: [EmailAuthService],
+  exports: [EmailAuthService],
+})
+export class EmailAuthModule {}

package/template/apps/api/libs/domain/db/src/modules/email-auth/email-auth.service.ts

@@ -0,0 +1,101 @@
+import { Injectable } from '@nestjs/common';
+import { ConfigService } from '@nestjs/config';
+import { PrismaService } from '@app/prisma';
+import { TransactionalServiceBase } from '@app/shared-db';
+import { HandlePrismaError, DbOperationType } from '@/utils/prisma-error.util';
+import { AppConfig } from '@/config/validation';
+import type { Prisma, EmailAuth } from '@prisma/client';
+
+@Injectable()
+export class EmailAuthService extends TransactionalServiceBase {
+  private appConfig: AppConfig;
+
+  constructor(
+    prisma: PrismaService,
+    private readonly config: ConfigService,
+  ) {
+    super(prisma);
+    this.appConfig = config.getOrThrow<AppConfig>('app');
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async get(
+    where: Prisma.EmailAuthWhereInput,
+    additional?: { select?: Prisma.EmailAuthSelect },
+  ): Promise<EmailAuth | null> {
+    return this.getReadClient().emailAuth.findFirst({
+      where: { ...where, isDeleted: false },
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async getById(
+    id: string,
+    additional?: { select?: Prisma.EmailAuthSelect },
+  ): Promise<EmailAuth | null> {
+    return this.getReadClient().emailAuth.findUnique({
+      where: { email: id, isDeleted: false },
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.QUERY)
+  async list(
+    where: Prisma.EmailAuthWhereInput,
+    pagination?: {
+      orderBy?: Prisma.EmailAuthOrderByWithRelationInput;
+      limit?: number;
+      page?: number;
+    },
+    additional?: { select?: Prisma.EmailAuthSelect },
+  ): Promise<{ list: EmailAuth[]; total: number; page: number; limit: number }> {
+    const {
+      orderBy = { createdAt: 'desc' },
+      limit = this.appConfig.MaxPageSize,
+      page = 1,
+    } = pagination || {};
+    const skip = (page - 1) * limit;
+
+    const [list, total] = await Promise.all([
+      this.getReadClient().emailAuth.findMany({
+        where: { ...where, isDeleted: false },
+        orderBy,
+        take: limit,
+        skip,
+        ...additional,
+      }),
+      this.getReadClient().emailAuth.count({
+        where: { ...where, isDeleted: false },
+      }),
+    ]);
+
+    return { list, total, page, limit };
+  }
+
+  @HandlePrismaError(DbOperationType.CREATE)
+  async create(
+    data: Prisma.EmailAuthCreateInput,
+    additional?: { select?: Prisma.EmailAuthSelect },
+  ): Promise<EmailAuth> {
+    return this.getWriteClient().emailAuth.create({ data, ...additional });
+  }
+
+  @HandlePrismaError(DbOperationType.UPDATE)
+  async update(
+    where: Prisma.EmailAuthWhereUniqueInput,
+    data: Prisma.EmailAuthUpdateInput,
+    additional?: { select?: Prisma.EmailAuthSelect },
+  ): Promise<EmailAuth> {
+    return this.getWriteClient().emailAuth.update({
+      where,
+      data,
+      ...additional,
+    });
+  }
+
+  @HandlePrismaError(DbOperationType.DELETE)
+  async delete(where: Prisma.EmailAuthWhereUniqueInput): Promise<EmailAuth> {
+    return this.getWriteClient().emailAuth.delete({ where });
+  }
+}

package/template/apps/api/libs/domain/db/src/modules/email-auth/index.ts

@@ -0,0 +1,2 @@
+export * from './email-auth.service';
+export * from './email-auth.module';

package/template/apps/api/libs/domain/db/src/modules/file-source/file-source.module.ts

@@ -0,0 +1,12 @@
+import { Module } from '@nestjs/common';
+import { FileSourceService } from './file-source.service';
+import { PrismaModule } from '@app/prisma';
+import { RedisModule } from '@app/redis';
+import { ConfigModule } from '@nestjs/config';
+
+@Module({
+  imports: [PrismaModule, RedisModule, ConfigModule],
+  providers: [FileSourceService],
+  exports: [FileSourceService],
+})
+export class FileSourceModule {}