feat(server): auth server (#2773)

apps/server/src/config/def.ts

@@ -163,6 +163,12 @@ export interface AFFiNEConfig {
      * }
      */
     config: Record<string, string>;
+    /**
+     * Only used when `enable` is `false`
+     */
+    fs: {
+      path: string;
+    };
   };
 
   /**
@@ -172,11 +178,16 @@ export interface AFFiNEConfig {
     /**
      * Application access token expiration time
      */
-    readonly accessTokenExpiresIn: string;
+    readonly accessTokenExpiresIn: number;
     /**
      * Application refresh token expiration time
      */
-    readonly refreshTokenExpiresIn: string;
+    readonly refreshTokenExpiresIn: number;
+    /**
+     * Add some leeway (in seconds) to the exp and nbf validation to account for clock skew.
+     * Defaults to 60 if omitted.
+     */
+    readonly leeway: number;
     /**
      * Application public key
      *
@@ -195,6 +206,10 @@ export interface AFFiNEConfig {
      * whether allow user to signup by oauth providers
      */
     enableOauth: boolean;
+    /**
+     * NEXTAUTH_SECRET
+     */
+    nextAuthSecret: string;
     /**
      * all available oauth providers
      */

apps/server/src/config/default.ts

@@ -1,5 +1,10 @@
 /// <reference types="../global.d.ts" />
 
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+
+import parse from 'parse-duration';
+
 import pkg from '../../package.json' assert { type: 'json' };
 import type { AFFiNEConfig } from './def';
 
@@ -56,16 +61,23 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => ({
     debug: true,
   },
   auth: {
-    accessTokenExpiresIn: '1h',
-    refreshTokenExpiresIn: '7d',
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    accessTokenExpiresIn: parse('1h')! / 1000,
+    // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
+    refreshTokenExpiresIn: parse('7d')! / 1000,
+    leeway: 60,
     publicKey: examplePublicKey,
     privateKey: examplePrivateKey,
     enableSignup: true,
     enableOauth: false,
+    nextAuthSecret: '',
     oauthProviders: {},
   },
   objectStorage: {
     enable: false,
     config: {},
+    fs: {
+      path: join(homedir(), '.affine-storage'),
+    },
   },
 });

apps/server/src/graphql.module.ts

@@ -16,6 +16,9 @@ import { Config } from './config';
         return {
           ...config.graphql,
           path: `${config.path}/graphql`,
+          csrfPrevention: {
+            requestHeaders: ['content-type'],
+          },
           autoSchemaFile: join(
             fileURLToPath(import.meta.url),
             '..',

apps/server/src/index.ts

@@ -2,8 +2,12 @@ import './prelude';
 
 import { NestFactory } from '@nestjs/core';
 import type { NestExpressApplication } from '@nestjs/platform-express';
+import { static as staticMiddleware } from 'express';
+// @ts-expect-error graphql-upload is not typed
+import graphqlUploadExpress from 'graphql-upload/graphqlUploadExpress.mjs';
 
 import { AppModule } from './app';
+import { Config } from './config';
 
 const app = await NestFactory.create<NestExpressApplication>(AppModule, {
   cors: {
@@ -12,14 +16,27 @@ const app = await NestFactory.create<NestExpressApplication>(AppModule, {
         ? ['https://affine-preview.vercel.app']
         : ['http://localhost:8080'],
     methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
-    allowedHeaders: '*',
+    allowedHeaders: ['x-operation-name', 'x-definition-name'],
   },
   bodyParser: true,
 });
 
+app.use(
+  graphqlUploadExpress({
+    maxFileSize: 10 * 1024 * 1024,
+    maxFiles: 5,
+  })
+);
+
 const host = process.env.HOST ?? 'localhost';
 const port = process.env.PORT ?? 3010;
 
+const config = app.get(Config);
+
+if (!config.objectStorage.enable) {
+  app.use('/assets', staticMiddleware(config.objectStorage.fs.path));
+}
+
 await app.listen(port, host);
 
 console.log(`Listening on http://${host}:${port}`);

apps/server/src/modules/auth/guard.ts

@@ -49,10 +49,17 @@ class AuthGuard implements CanActivate {
     if (!token) {
       return false;
     }
+    const [type, jwt] = token.split(' ') ?? [];
 
-    const claims = this.auth.verify(token);
-    req.user = await this.prisma.user.findUnique({ where: { id: claims.id } });
-    return !!req.user;
+    if (type === 'Bearer') {
+      const claims = await this.auth.verify(jwt);
+      req.user = await this.prisma.user.findUnique({
+        where: { id: claims.id },
+      });
+      return !!req.user;
+    }
+
+    return false;
   }
 }
 

apps/server/src/modules/auth/index.ts

@@ -1,5 +1,6 @@
 import { Global, Module } from '@nestjs/common';
 
+import { NextAuthController } from './next-auth.controller';
 import { AuthResolver } from './resolver';
 import { AuthService } from './service';
 
@@ -7,6 +8,7 @@ import { AuthService } from './service';
 @Module({
   providers: [AuthService, AuthResolver],
   exports: [AuthService],
+  controllers: [NextAuthController],
 })
 export class AuthModule {}
 export * from './guard';

apps/server/src/modules/auth/next-auth.controller.ts

@@ -0,0 +1,158 @@
+import { randomUUID } from 'node:crypto';
+
+import { PrismaAdapter } from '@auth/prisma-adapter';
+import {
+  BadRequestException,
+  Controller,
+  Get,
+  Next,
+  Post,
+  Query,
+  Req,
+  Res,
+} from '@nestjs/common';
+import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
+import type { NextFunction, Request, Response } from 'express';
+import type { AuthAction, AuthOptions } from 'next-auth';
+import { AuthHandler } from 'next-auth/core';
+import Github from 'next-auth/providers/github';
+import Google from 'next-auth/providers/google';
+
+import { Config } from '../../config';
+import { PrismaService } from '../../prisma/service';
+import { getUtcTimestamp, type UserClaim } from './service';
+
+const BASE_URL = '/api/auth/';
+
+@Controller(BASE_URL)
+export class NextAuthController {
+  private readonly nextAuthOptions: AuthOptions;
+
+  constructor(readonly config: Config, readonly prisma: PrismaService) {
+    this.nextAuthOptions = {
+      providers: [],
+      // @ts-expect-error Third part library type mismatch
+      adapter: PrismaAdapter(prisma),
+    };
+
+    if (config.auth.oauthProviders.github) {
+      this.nextAuthOptions.providers.push(
+        Github({
+          clientId: config.auth.oauthProviders.github.clientId,
+          clientSecret: config.auth.oauthProviders.github.clientSecret,
+        })
+      );
+    }
+
+    if (config.auth.oauthProviders.google) {
+      this.nextAuthOptions.providers.push(
+        Google({
+          clientId: config.auth.oauthProviders.google.clientId,
+          clientSecret: config.auth.oauthProviders.google.clientSecret,
+        })
+      );
+    }
+    this.nextAuthOptions.jwt = {
+      encode: async ({ token, maxAge }) => {
+        if (!token?.email) {
+          throw new BadRequestException('Missing email in jwt token');
+        }
+        const user = await this.prisma.user.findFirstOrThrow({
+          where: {
+            email: token.email,
+          },
+        });
+        const now = getUtcTimestamp();
+        return sign(
+          {
+            data: {
+              id: user.id,
+              name: user.name,
+              email: user.email,
+              createdAt: user.createdAt.toISOString(),
+            },
+            iat: now,
+            exp: now + (maxAge ?? config.auth.accessTokenExpiresIn),
+            iss: this.config.serverId,
+            sub: user.id,
+            aud: user.name,
+            jti: randomUUID({
+              disableEntropyCache: true,
+            }),
+          },
+          this.config.auth.privateKey,
+          {
+            algorithm: Algorithm.ES256,
+          }
+        );
+      },
+      decode: async ({ token }) => {
+        if (!token) {
+          return null;
+        }
+        const { name, email, id } = (
+          await jwtVerify(token, this.config.auth.publicKey, {
+            algorithms: [Algorithm.ES256],
+            iss: [this.config.serverId],
+            leeway: this.config.auth.leeway,
+            requiredSpecClaims: ['exp', 'iat', 'iss', 'sub'],
+          })
+        ).data as UserClaim;
+        return {
+          name,
+          email,
+          sub: id,
+        };
+      },
+    };
+    this.nextAuthOptions.secret ??= config.auth.nextAuthSecret;
+  }
+
+  @Get()
+  @Post()
+  async auth(
+    @Req() req: Request,
+    @Res() res: Response,
+    @Query() query: Record<string, any>,
+    @Next() next: NextFunction
+  ) {
+    const nextauth = req.url // start with request url
+      .slice(BASE_URL.length) // make relative to baseUrl
+      .replace(/\?.*/, '') // remove query part, use only path part
+      .split('/') as AuthAction[]; // as array of strings;
+    const { status, headers, body, redirect, cookies } = await AuthHandler({
+      req: {
+        body: req.body,
+        query: query,
+        method: req.method,
+        action: nextauth[0],
+        providerId: nextauth[1],
+        error: query.error ?? nextauth[1],
+        cookies: req.cookies,
+      },
+      options: this.nextAuthOptions,
+    });
+    if (status) {
+      res.status(status);
+    }
+    if (headers) {
+      for (const { key, value } of headers) {
+        res.setHeader(key, value);
+      }
+    }
+    if (cookies) {
+      for (const cookie of cookies) {
+        res.cookie(cookie.name, cookie.value, cookie.options);
+      }
+    }
+    if (redirect) {
+      res.redirect(redirect);
+    } else if (typeof body === 'string') {
+      res.send(body);
+    } else if (body && typeof body === 'object') {
+      res.json(body);
+    } else {
+      next();
+    }
+  }
+}

apps/server/src/modules/auth/resolver.ts

@@ -50,4 +50,16 @@ export class AuthResolver {
     ctx.req.user = user;
     return user;
   }
+
+  @Mutation(() => UserType)
+  async signUp(
+    @Context() ctx: { req: Request },
+    @Args('email') email: string,
+    @Args('password') password: string,
+    @Args('name') name: string
+  ) {
+    const user = await this.auth.register(name, email, password);
+    ctx.req.user = user;
+    return user;
+  }
 }

apps/server/src/modules/auth/service.ts

@@ -1,44 +1,88 @@
+import { randomUUID } from 'node:crypto';
+
 import {
   BadRequestException,
   Injectable,
+  InternalServerErrorException,
   UnauthorizedException,
 } from '@nestjs/common';
-import { compare, hash } from '@node-rs/bcrypt';
+import { hash, verify } from '@node-rs/argon2';
+import { Algorithm, sign, verify as jwtVerify } from '@node-rs/jsonwebtoken';
 import type { User } from '@prisma/client';
-import jwt from 'jsonwebtoken';
 
 import { Config } from '../../config';
 import { PrismaService } from '../../prisma';
 
-type UserClaim = Pick<User, 'id' | 'name' | 'email'>;
+export type UserClaim = Pick<User, 'id' | 'name' | 'email' | 'createdAt'>;
+
+export const getUtcTimestamp = () => Math.floor(new Date().getTime() / 1000);
 
 @Injectable()
 export class AuthService {
   constructor(private config: Config, private prisma: PrismaService) {}
 
   sign(user: UserClaim) {
-    return jwt.sign(user, this.config.auth.privateKey, {
-      algorithm: 'ES256',
-      subject: user.id,
-      issuer: this.config.serverId,
-      expiresIn: this.config.auth.accessTokenExpiresIn,
-    });
+    const now = getUtcTimestamp();
+    return sign(
+      {
+        data: {
+          id: user.id,
+          name: user.name,
+          email: user.email,
+          createdAt: user.createdAt.toISOString(),
+        },
+        iat: now,
+        exp: now + this.config.auth.accessTokenExpiresIn,
+        iss: this.config.serverId,
+        sub: user.id,
+        aud: user.name,
+        jti: randomUUID({
+          disableEntropyCache: true,
+        }),
+      },
+      this.config.auth.privateKey,
+      {
+        algorithm: Algorithm.ES256,
+      }
+    );
   }
 
   refresh(user: UserClaim) {
-    return jwt.sign(user, this.config.auth.privateKey, {
-      algorithm: 'ES256',
-      subject: user.id,
-      issuer: this.config.serverId,
-      expiresIn: this.config.auth.refreshTokenExpiresIn,
-    });
+    const now = getUtcTimestamp();
+    return sign(
+      {
+        data: {
+          id: user.id,
+          name: user.name,
+          email: user.email,
+          createdAt: user.createdAt.toISOString(),
+        },
+        exp: now + this.config.auth.refreshTokenExpiresIn,
+        iat: now,
+        iss: this.config.serverId,
+        sub: user.id,
+        aud: user.name,
+        jti: randomUUID({
+          disableEntropyCache: true,
+        }),
+      },
+      this.config.auth.privateKey,
+      {
+        algorithm: Algorithm.ES256,
+      }
+    );
   }
 
-  verify(token: string) {
+  async verify(token: string) {
     try {
-      return jwt.verify(token, this.config.auth.publicKey, {
-        algorithms: ['ES256'],
-      }) as UserClaim;
+      return (
+        await jwtVerify(token, this.config.auth.publicKey, {
+          algorithms: [Algorithm.ES256],
+          iss: [this.config.serverId],
+          leeway: this.config.auth.leeway,
+          requiredSpecClaims: ['exp', 'iat', 'iss', 'sub'],
+        })
+      ).data as UserClaim;
     } catch (e) {
       throw new UnauthorizedException('Invalid token');
     }
@@ -58,9 +102,13 @@ export class AuthService {
     if (!user.password) {
       throw new BadRequestException('User has no password');
     }
-
-    const equal = await compare(password, user.password);
-
+    let equal = false;
+    try {
+      equal = await verify(user.password, password);
+    } catch (e) {
+      console.error(e);
+      throw new InternalServerErrorException(e, 'Verify password failed');
+    }
     if (!equal) {
       throw new UnauthorizedException('Invalid password');
     }
@@ -69,8 +117,6 @@ export class AuthService {
   }
 
   async register(name: string, email: string, password: string): Promise<User> {
-    const hashedPassword = await hash(password);
-
     const user = await this.prisma.user.findFirst({
       where: {
         email,
@@ -81,6 +127,8 @@ export class AuthService {
       throw new BadRequestException('Email already exists');
     }
 
+    const hashedPassword = await hash(password);
+
     return this.prisma.user.create({
       data: {
         name,

apps/server/src/modules/storage/fs.ts

@@ -0,0 +1,23 @@
+import { createWriteStream } from 'node:fs';
+import { mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { pipeline } from 'node:stream/promises';
+
+import { Injectable } from '@nestjs/common';
+
+import { Config } from '../../config';
+import { FileUpload } from '../../types';
+
+@Injectable()
+export class FSService {
+  constructor(private readonly config: Config) {}
+
+  async writeFile(key: string, file: FileUpload) {
+    const dest = this.config.objectStorage.fs.path;
+    await mkdir(dest, { recursive: true });
+    const destFile = join(dest, key);
+    await pipeline(file.createReadStream(), createWriteStream(destFile));
+
+    return `/assets/${destFile}`;
+  }
+}

apps/server/src/modules/storage/index.ts

@@ -0,0 +1,11 @@
+import { Module } from '@nestjs/common';
+
+import { FSService } from './fs';
+import { S3 } from './s3';
+import { StorageService } from './storage.service';
+
+@Module({
+  providers: [S3, StorageService, FSService],
+  exports: [StorageService],
+})
+export class StorageModule {}

apps/server/src/modules/storage/s3.ts

@@ -0,0 +1,15 @@
+import { S3Client } from '@aws-sdk/client-s3';
+import { FactoryProvider } from '@nestjs/common';
+
+import { Config } from '../../config';
+
+export const S3_SERVICE = Symbol('S3_SERVICE');
+
+export const S3: FactoryProvider<S3Client> = {
+  provide: S3_SERVICE,
+  useFactory: (config: Config) => {
+    const s3 = new S3Client(config.objectStorage.config);
+    return s3;
+  },
+  inject: [Config],
+};

apps/server/src/modules/storage/storage.service.ts

@@ -0,0 +1,31 @@
+import { PutObjectCommand, S3Client } from '@aws-sdk/client-s3';
+import { Inject, Injectable } from '@nestjs/common';
+
+import { Config } from '../../config';
+import { FileUpload } from '../../types';
+import { FSService } from './fs';
+import { S3_SERVICE } from './s3';
+
+@Injectable()
+export class StorageService {
+  constructor(
+    @Inject(S3_SERVICE) private readonly s3: S3Client,
+    private readonly fs: FSService,
+    private readonly config: Config
+  ) {}
+
+  async uploadFile(key: string, file: FileUpload) {
+    if (this.config.objectStorage.enable) {
+      await this.s3.send(
+        new PutObjectCommand({
+          Body: file.createReadStream(),
+          Bucket: this.config.objectStorage.config.bucket,
+          Key: key,
+        })
+      );
+      return `https://avatar.affineassets.com/${key}`;
+    } else {
+      return this.fs.writeFile(key, file);
+    }
+  }
+}

apps/server/src/modules/users/index.ts

@@ -1,8 +1,10 @@
 import { Module } from '@nestjs/common';
 
+import { StorageModule } from '../storage';
 import { UserResolver } from './resolver';
 
 @Module({
+  imports: [StorageModule],
   providers: [UserResolver],
 })
 export class UsersModule {}

apps/server/src/modules/users/resolver.ts

@@ -1,7 +1,21 @@
-import { Args, Field, ID, ObjectType, Query, Resolver } from '@nestjs/graphql';
+import { BadRequestException } from '@nestjs/common';
+import {
+  Args,
+  Field,
+  ID,
+  Mutation,
+  ObjectType,
+  Query,
+  Resolver,
+} from '@nestjs/graphql';
 import type { User } from '@prisma/client';
+// @ts-expect-error graphql-upload is not typed
+import GraphQLUpload from 'graphql-upload/GraphQLUpload.mjs';
 
 import { PrismaService } from '../../prisma/service';
+import type { FileUpload } from '../../types';
+import { Auth } from '../auth/guard';
+import { StorageService } from '../storage/storage.service';
 
 @ObjectType()
 export class UserType implements Partial<User> {
@@ -21,9 +35,13 @@ export class UserType implements Partial<User> {
   createdAt!: Date;
 }
 
+@Auth()
 @Resolver(() => UserType)
 export class UserResolver {
-  constructor(private readonly prisma: PrismaService) {}
+  constructor(
+    private readonly prisma: PrismaService,
+    private readonly storage: StorageService
+  ) {}
 
   @Query(() => UserType, {
     name: 'user',
@@ -34,4 +52,24 @@ export class UserResolver {
       where: { email },
     });
   }
+
+  @Mutation(() => UserType, {
+    name: 'uploadAvatar',
+    description: 'Upload user avatar',
+  })
+  async uploadAvatar(
+    @Args('id') id: string,
+    @Args({ name: 'avatar', type: () => GraphQLUpload })
+    avatar: FileUpload
+  ) {
+    const user = await this.prisma.user.findUnique({ where: { id } });
+    if (!user) {
+      throw new BadRequestException(`User ${id} not found`);
+    }
+    const url = await this.storage.uploadFile(`${id}-avatar`, avatar);
+    return this.prisma.user.update({
+      where: { id },
+      data: { avatarUrl: url },
+    });
+  }
 }

apps/server/src/tests/app.e2e.ts

@@ -1,10 +1,14 @@
 import { equal, ok } from 'node:assert';
 import { afterEach, beforeEach, describe, test } from 'node:test';
 
+import { Transformer } from '@napi-rs/image';
 import type { INestApplication } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
-import { hash } from '@node-rs/bcrypt';
+import { hash } from '@node-rs/argon2';
 import { PrismaClient } from '@prisma/client';
+import { Express } from 'express';
+// @ts-expect-error graphql-upload is not typed
+import graphqlUploadExpress from 'graphql-upload/graphqlUploadExpress.mjs';
 import request from 'supertest';
 
 import { AppModule } from '../app';
@@ -24,7 +28,6 @@ describe('AppModule', () => {
     await client.user.deleteMany({});
     await client.user.create({
       data: {
-        id: '1',
         name: 'Alex Yang',
         email: 'alex.yang@example.org',
         password: await hash('123456'),
@@ -36,7 +39,16 @@ describe('AppModule', () => {
     const module = await Test.createTestingModule({
       imports: [AppModule],
     }).compile();
-    app = module.createNestApplication();
+    app = module.createNestApplication({
+      cors: true,
+      bodyParser: true,
+    });
+    app.use(
+      graphqlUploadExpress({
+        maxFileSize: 10 * 1024 * 1024,
+        maxFiles: 5,
+      })
+    );
     await app.init();
   });
 
@@ -57,32 +69,11 @@ describe('AppModule', () => {
       })
       .expect(400);
 
-    let token;
-    await request(app.getHttpServer())
-      .post(gql)
-      .send({
-        query: `
-          mutation {
-            signIn(email: "alex.yang@example.org", password: "123456") {
-              token {
-                token
-              }
-            }
-          }
-        `,
-      })
-      .expect(200)
-      .expect(res => {
-        ok(
-          typeof res.body.data.signIn.token.token === 'string',
-          'res.body.data.signIn.token.token is not a string'
-        );
-        token = res.body.data.signIn.token.token;
-      });
+    const { token } = await createToken(app);
 
     await request(app.getHttpServer())
       .post(gql)
-      .set({ Authorization: token })
+      .auth(token, { type: 'bearer' })
       .send({
         query: `
       mutation {
@@ -116,8 +107,10 @@ describe('AppModule', () => {
   });
 
   test('should find default user', async () => {
+    const { token } = await createToken(app);
     await request(app.getHttpServer())
       .post(gql)
+      .auth(token, { type: 'bearer' })
       .send({
         query: `
       query {
@@ -133,4 +126,72 @@ describe('AppModule', () => {
         equal(res.body.data.user.email, 'alex.yang@example.org');
       });
   });
+
+  test('should be able to upload avatar', async () => {
+    const { token, id } = await createToken(app);
+    const png = await Transformer.fromRgbaPixels(
+      Buffer.alloc(400 * 400 * 4).fill(255),
+      400,
+      400
+    ).png();
+
+    await request(app.getHttpServer())
+      .post(gql)
+      .auth(token, { type: 'bearer' })
+      .field(
+        'operations',
+        JSON.stringify({
+          name: 'uploadAvatar',
+          query: `mutation uploadAvatar($id: String!, $avatar: Upload!) {
+          uploadAvatar(id: $id, avatar: $avatar) {
+            id
+            name
+            avatarUrl
+            email
+          }
+        }
+        `,
+          variables: { id, avatar: null },
+        })
+      )
+
+      .field('map', JSON.stringify({ '0': ['variables.avatar'] }))
+      .attach('0', png, 'avatar.png')
+      .expect(200)
+      .expect(res => {
+        equal(res.body.data.uploadAvatar.id, id);
+      });
+  });
 });
+
+async function createToken(app: INestApplication<Express>): Promise<{
+  id: string;
+  token: string;
+}> {
+  let token;
+  let id;
+  await request(app.getHttpServer())
+    .post(gql)
+    .send({
+      query: `
+          mutation {
+            signIn(email: "alex.yang@example.org", password: "123456") {
+              id
+              token {
+                token
+              }
+            }
+          }
+        `,
+    })
+    .expect(200)
+    .expect(res => {
+      id = res.body.data.signIn.id;
+      ok(
+        typeof res.body.data.signIn.token.token === 'string',
+        'res.body.data.signIn.token.token is not a string'
+      );
+      token = res.body.data.signIn.token.token;
+    });
+  return { token: token!, id: id! };
+}

apps/server/src/tests/auth.spec.ts

@@ -1,7 +1,6 @@
-import { ok, throws } from 'node:assert';
+import { ok } from 'node:assert';
 import { beforeEach, test } from 'node:test';
 
-import { UnauthorizedException } from '@nestjs/common';
 import { Test } from '@nestjs/testing';
 import { PrismaClient } from '@prisma/client';
 
@@ -28,8 +27,9 @@ beforeEach(async () => {
     imports: [
       ConfigModule.forRoot({
         auth: {
-          accessTokenExpiresIn: '1s',
-          refreshTokenExpiresIn: '3s',
+          accessTokenExpiresIn: 1,
+          refreshTokenExpiresIn: 1,
+          leeway: 1,
         },
       }),
       PrismaModule,
@@ -40,12 +40,6 @@ beforeEach(async () => {
   auth = module.get(AuthService);
 });
 
-async function sleep(ms: number) {
-  return new Promise<void>(resolve => {
-    setTimeout(resolve, ms);
-  });
-}
-
 test('should be able to register and signIn', async () => {
   await auth.register('Alex Yang', 'alexyang@example.org', '123456');
   await auth.signIn('alexyang@example.org', '123456');
@@ -58,23 +52,20 @@ test('should be able to verify', async () => {
     id: '1',
     name: 'Alex Yang',
     email: 'alexyang@example.org',
+    createdAt: new Date(),
   };
   {
-    const token = auth.sign(user);
-    const clain = auth.verify(token);
-    ok(clain.id === '1');
-    ok(clain.name === 'Alex Yang');
-    ok(clain.email === 'alexyang@example.org');
-    await sleep(1050);
-    throws(() => auth.verify(token), UnauthorizedException, 'Invalid token');
+    const token = await auth.sign(user);
+    const claim = await auth.verify(token);
+    ok(claim.id === '1');
+    ok(claim.name === 'Alex Yang');
+    ok(claim.email === 'alexyang@example.org');
   }
   {
-    const token = auth.refresh(user);
-    const clain = auth.verify(token);
-    ok(clain.id === '1');
-    ok(clain.name === 'Alex Yang');
-    ok(clain.email === 'alexyang@example.org');
-    await sleep(3050);
-    throws(() => auth.verify(token), UnauthorizedException, 'Invalid token');
+    const token = await auth.refresh(user);
+    const claim = await auth.verify(token);
+    ok(claim.id === '1');
+    ok(claim.name === 'Alex Yang');
+    ok(claim.email === 'alexyang@example.org');
   }
 });

apps/server/src/types.ts

@@ -0,0 +1,8 @@
+import { Readable } from 'node:stream';
+
+export interface FileUpload {
+  filename: string;
+  mimetype: string;
+  encoding: string;
+  createReadStream: () => Readable;
+}