133 lines
4.3 KiB
TypeScript
Executable File
133 lines
4.3 KiB
TypeScript
Executable File
import { createHash, randomBytes } from 'node:crypto';
|
|
import { EntityManager } from '@mikro-orm/postgresql';
|
|
import { Injectable, Logger, UnauthorizedException } from '@nestjs/common';
|
|
import { ConfigService } from '@nestjs/config';
|
|
import { JwtService } from '@nestjs/jwt';
|
|
import dayjs from 'dayjs';
|
|
import { RefreshTokenType } from '../interfaces/IToken-payload';
|
|
import { AuthMessage } from '../../../common/enums/message.enum';
|
|
import { RefreshToken } from '../entities/refresh-token.entity';
|
|
import { IAdminTokenPayload, ITokenPayload } from '../interfaces/IToken-payload';
|
|
|
|
|
|
@Injectable()
|
|
export class TokensService {
|
|
|
|
private readonly logger = new Logger(TokensService.name);
|
|
constructor(
|
|
private readonly configService: ConfigService,
|
|
private readonly jwtService: JwtService,
|
|
private readonly em: EntityManager,
|
|
) { }
|
|
|
|
async generateAccessAndRefreshToken(
|
|
ownerId: string,
|
|
isAdmin: boolean,
|
|
em?: EntityManager,
|
|
) {
|
|
const refreshExpire = this.configService.getOrThrow<number>('REFRESH_TOKEN_EXPIRE');
|
|
const accessExpire = this.configService.getOrThrow<number>('JWT_EXPIRATION_TIME');
|
|
|
|
const payload: ITokenPayload | IAdminTokenPayload = isAdmin
|
|
? { adminId: ownerId, }
|
|
: { userId: ownerId };
|
|
|
|
const accessToken = await this.generateAccessToken(payload, accessExpire);
|
|
const refreshToken = this.generateRefreshToken();
|
|
const type = isAdmin ? RefreshTokenType.ADMIN : RefreshTokenType.USER;
|
|
|
|
// Only pass em if it's a transaction manager (not this.em), otherwise pass undefined to trigger flush
|
|
await this.storeRefreshToken(ownerId, refreshToken, type, em);
|
|
|
|
return {
|
|
accessToken: { token: accessToken, expire: dayjs().add(accessExpire, 'seconds').valueOf() },
|
|
refreshToken: { token: refreshToken, expire: dayjs().add(refreshExpire, 'day').valueOf() },
|
|
};
|
|
}
|
|
|
|
private generateAccessToken(payload: ITokenPayload | IAdminTokenPayload, expiresIn: number) {
|
|
return this.jwtService.signAsync(payload, { expiresIn: `${expiresIn}s` });
|
|
}
|
|
|
|
async storeRefreshToken(
|
|
ownerId: string,
|
|
refreshToken: string,
|
|
type: RefreshTokenType,
|
|
em?: EntityManager,
|
|
) {
|
|
const entityManager = em || this.em;
|
|
const refreshExpire = this.configService.getOrThrow<number>('REFRESH_TOKEN_EXPIRE');
|
|
const expiresAt = dayjs().add(refreshExpire, 'day').toDate();
|
|
|
|
const hashedToken = this.hashToken(refreshToken);
|
|
|
|
const token = entityManager.create(RefreshToken, {
|
|
hashedToken,
|
|
ownerId,
|
|
type,
|
|
expiresAt,
|
|
});
|
|
|
|
if (em) {
|
|
// Within transaction, just persist (flush will be called by transaction)
|
|
entityManager.persist(token);
|
|
} else {
|
|
// Outside transaction, persist and flush immediately
|
|
await entityManager.persistAndFlush(token);
|
|
}
|
|
}
|
|
|
|
async refreshToken(oldRefreshToken: string) {
|
|
const hashedToken = this.hashToken(oldRefreshToken);
|
|
|
|
return this.em.transactional(async em => {
|
|
|
|
const token = await em.findOne(RefreshToken, { hashedToken });
|
|
|
|
if (!token) {
|
|
throw new UnauthorizedException(AuthMessage.INVALID_REFRESH_TOKEN);
|
|
}
|
|
|
|
// Check expiration
|
|
if (dayjs(token.expiresAt).isBefore(dayjs())) {
|
|
em.remove(token);
|
|
await em.flush();
|
|
throw new UnauthorizedException(AuthMessage.REFRESH_TOKEN_EXPIRED);
|
|
}
|
|
|
|
// Store token data before removal
|
|
const ownerId = token.ownerId;
|
|
const isAdmin = token.type === RefreshTokenType.ADMIN;
|
|
|
|
|
|
try {
|
|
// Generate new tokens first (before removing old token)
|
|
// Pass the transaction EntityManager to ensure operations are within the transaction
|
|
const tokens = await this.generateAccessAndRefreshToken(ownerId, isAdmin, em);
|
|
|
|
// Remove old token only after new token is created
|
|
em.remove(token);
|
|
|
|
// Persist changes atomically
|
|
await em.flush();
|
|
|
|
return tokens;
|
|
} catch (error) {
|
|
this.logger.error('Failed to generate new tokens after refresh', error);
|
|
// Transaction will rollback automatically, preserving the old token
|
|
throw new UnauthorizedException('Failed to refresh token');
|
|
}
|
|
});
|
|
}
|
|
|
|
private generateRefreshToken() {
|
|
return randomBytes(32).toString('hex');
|
|
}
|
|
|
|
private hashToken(token: string): string {
|
|
return createHash('sha256').update(token).digest('hex');
|
|
}
|
|
|
|
}
|
|
|