认证与授权：Passport 与 JWT

npm i bcrypt
npm i -D @types/bcrypt

// src/auth/auth.service.ts（注册侧）
import * as bcrypt from "bcrypt"

async register(email: string, password: string) {
  const hash = await bcrypt.hash(password, 10)   // 10 = cost factor
  return this.prisma.user.create({ data: { email, passwordHash: hash } })
}

async verifyPassword(password: string, hash: string) {
  return bcrypt.compare(password, hash)          // 比对而非解密
}

// src/auth/auth.module.ts
import { JwtModule } from "@nestjs/jwt"
import { ConfigService } from "@nestjs/config"

@Module({
  imports: [
    JwtModule.registerAsync({
      inject: [ConfigService],
      useFactory: (config: ConfigService) => ({
        secret: config.get("JWT_SECRET"),        // 密钥来自环境配置（nestjs/220）
        signOptions: { expiresIn: "15m" }        // 访问令牌短命
      })
    })
  ],
  providers: [AuthService],
  exports: [JwtModule]                            // 导出后其他模块可复用 JwtService
})
export class AuthModule {}

// 签发
const payload = { sub: user.id, email: user.email, role: user.role }
const accessToken = await this.jwt.signAsync(payload)

npm i @nestjs/passport passport passport-local passport-jwt
npm i -D @types/passport-local @types/passport-jwt

// src/auth/strategies/local.strategy.ts
import { Injectable, UnauthorizedException } from "@nestjs/common"
import { PassportStrategy } from "@nestjs/passport"
import { Strategy } from "passport-local"
import { AuthService } from "../auth.service"

@Injectable()
export class LocalStrategy extends PassportStrategy(Strategy) {
  constructor(private readonly auth: AuthService) {
    super()                                        // 默认按 username/password 字段取参
  }

  async validate(email: string, password: string) {
    const user = await this.auth.validateUser(email, password) // 内部 bcrypt.compare
    if (!user) throw new UnauthorizedException("邮箱或密码错误")
    return user                                    // 返回值挂在 request.user 上
  }
}

// src/auth/strategies/jwt.strategy.ts
import { ExtractJwt } from "passport-jwt"
import { ConfigService } from "@nestjs/config"

@Injectable()
export class JwtStrategy extends PassportStrategy(Strategy) {
  constructor(config: ConfigService) {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(), // Authorization: Bearer <token>
      ignoreExpiration: false,                    // 过期令牌直接拒绝
      secretOrKey: config.get("JWT_SECRET")
    })
  }

  async validate(payload: { sub: string; email: string }) {
    // payload 是签发时的内容（已验签、未过期）
    return { userId: payload.sub, email: payload.email }       // 挂到 request.user
  }
}

// src/auth/auth.controller.ts
@Controller("auth")
export class AuthController {
  constructor(private readonly auth: AuthService) {}

  @UseGuards(AuthGuard("local"))                  // local 策略跑在守卫层
  @Post("login")
  async login(@Request() req) {
    return this.auth.login(req.user)              // validate 已认出用户，这里签发令牌
  }

  @UseGuards(AuthGuard("jwt"))                    // 需要 JWT 的接口
  @Get("profile")
  profile(@Request() req) {
    return req.user
  }
}

// src/auth/public.decorator.ts
export const IS_PUBLIC_KEY = "isPublic"
export const Public = () => SetMetadata(IS_PUBLIC_KEY, true)

// src/auth/jwt-auth.guard.ts —— 全局守卫的豁免逻辑
@Injectable()
export class JwtAuthGuard extends AuthGuard("jwt") {
  constructor(private reflector: Reflector) {
    super()
  }

  canActivate(context: ExecutionContext) {
    const isPublic = this.reflector.getAllAndOverride<boolean>(IS_PUBLIC_KEY, [
      context.getHandler(),
      context.getClass()
    ])
    if (isPublic) return true                     // 公开接口直接放行
    return super.canActivate(context)             // 其余走 JWT 校验
  }
}

// AppModule：providers: [{ provide: APP_GUARD, useClass: JwtAuthGuard }]

async login(user: any) {
  const payload = { sub: user.id, email: user.email }
  return {
    accessToken: await this.jwt.signAsync(payload),                     // 15 分钟
    refreshToken: await this.jwt.signAsync(payload, { expiresIn: "7d" }) // 7 天
  }
}

async refresh(refreshToken: string) {
  // 1. 验签 + 校验类型（见下方防御）
  const payload = await this.jwt.verifyAsync(refreshToken)
  // 2. 轮换：旧刷新令牌作废，签发新的一对
  const user = await this.users.findById(payload.sub)
  return this.login(user)      // 新 accessToken + 新 refreshToken
}

npm i passport-google-oauth20

@Injectable()
export class GoogleStrategy extends PassportStrategy(Strategy, "google") {
  constructor(config: ConfigService) {
    super({
      clientID: config.get("GOOGLE_CLIENT_ID"),
      clientSecret: config.get("GOOGLE_CLIENT_SECRET"),
      callbackURL: "/auth/google/callback",
      scope: ["email", "profile"]
    })
  }

  async validate(accessToken: string, refreshToken: string, profile: any) {
    // profile 是第三方认定的身份：找/建本地用户（upsert），返回统一 user 对象
    return this.users.upsertOAuthUser("google", profile.id, profile.emails[0].value)
  }
}

// 控制器
@Get("google")
@UseGuards(AuthGuard("google"))
googleLogin() {}                                   // 触发重定向到 Google

@Get("google/callback")
@UseGuards(AuthGuard("google"))
googleCallback(@Request() req) {
  return this.auth.login(req.user)                 // 与本地登录共用签发逻辑
}