refactor(server): auth (#5895)

Remove `next-auth` and implement our own Authorization/Authentication system from scratch.

## Server

- [x] tokens
  - [x] function
  - [x] encryption

- [x] AuthController
  - [x] /api/auth/sign-in
  - [x] /api/auth/sign-out
  - [x] /api/auth/session
  - [x] /api/auth/session (WE SUPPORT MULTI-ACCOUNT!)

- [x] OAuthPlugin
  - [x] OAuthController
  - [x] /oauth/login
  - [x] /oauth/callback
  - [x] Providers
    - [x] Google
    - [x] GitHub

## Client

- [x] useSession
- [x] cloudSignIn
- [x] cloudSignOut

## NOTE:

Tests will be adding in the future

packages/backend/server/src/fundamentals/config/def.ts

@@ -87,6 +87,22 @@ export interface AFFiNEConfig {
     sync: boolean;
   };
 
+  /**
+   * Application secrets for authentication and data encryption
+   */
+  secrets: {
+    /**
+     * Application public key
+     *
+     */
+    publicKey: string;
+    /**
+     * Application private key
+     *
+     */
+    privateKey: string;
+  };
+
   /**
    * Deployment environment
    */
@@ -204,67 +220,32 @@ export interface AFFiNEConfig {
    * authentication config
    */
   auth: {
+    session: {
+      /**
+       * Application auth expiration time in seconds
+       *
+       * @default 15 days
+       */
+      ttl: number;
+    };
+
     /**
-     * Application access token expiration time
+     * Application access token config
      */
-    readonly accessTokenExpiresIn: number;
-    /**
-     * Application refresh token expiration time
-     */
-    readonly refreshTokenExpiresIn: number;
-    /**
-     * Add some leeway (in seconds) to the exp and nbf validation to account for clock skew.
-     * Defaults to 60 if omitted.
-     */
-    readonly leeway: number;
-    /**
-     * Application public key
-     *
-     */
-    readonly publicKey: string;
-    /**
-     * Application private key
-     *
-     */
-    readonly privateKey: string;
-    /**
-     * whether allow user to signup with email directly
-     */
-    enableSignup: boolean;
-    /**
-     * whether allow user to signup by oauth providers
-     */
-    enableOauth: boolean;
-    /**
-     * NEXTAUTH_SECRET
-     */
-    nextAuthSecret: string;
-    /**
-     * all available oauth providers
-     */
-    oauthProviders: Partial<
-      Record<
-        ExternalAccount,
-        {
-          enabled: boolean;
-          clientId: string;
-          clientSecret: string;
-          /**
-           * uri to start oauth flow
-           */
-          authorizationUri?: string;
-          /**
-           * uri to authenticate `access_token` when user is redirected back from oauth provider with `code`
-           */
-          accessTokenUri?: string;
-          /**
-           * uri to get user info with authenticated `access_token`
-           */
-          userInfoUri?: string;
-          args?: Record<string, any>;
-        }
-      >
-    >;
+    accessToken: {
+      /**
+       * Application access token expiration time in seconds
+       *
+       * @default 7 days
+       */
+      ttl: number;
+      /**
+       * Application refresh token expiration time in seconds
+       *
+       * @default 30 days
+       */
+      refreshTokenTtl: number;
+    };
     captcha: {
       /**
        * whether to enable captcha

packages/backend/server/src/fundamentals/config/default.ts

@@ -3,7 +3,6 @@
 import { createPrivateKey, createPublicKey } from 'node:crypto';
 
 import { merge } from 'lodash-es';
-import parse from 'parse-duration';
 
 import pkg from '../../../package.json' assert { type: 'json' };
 import {
@@ -23,7 +22,9 @@ AwEHoUQDQgAEF3U/0wIeJ3jRKXeFKqQyBKlr9F7xaAUScRrAuSP33rajm3cdfihI
 3JvMxVNsS2lE8PSGQrvDrJZaDo0L+Lq9Gg==
 -----END EC PRIVATE KEY-----`;
 
-const jwtKeyPair = (function () {
+const ONE_DAY_IN_SEC = 60 * 60 * 24;
+
+const keyPair = (function () {
   const AUTH_PRIVATE_KEY = process.env.AUTH_PRIVATE_KEY ?? examplePrivateKey;
   const privateKey = createPrivateKey({
     key: Buffer.from(AUTH_PRIVATE_KEY),
@@ -114,6 +115,10 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
     get deploy() {
       return !this.node.dev && !this.node.test;
     },
+    secrets: {
+      privateKey: keyPair.privateKey,
+      publicKey: keyPair.publicKey,
+    },
     featureFlags: {
       earlyAccessPreview: false,
       syncClientVersionCheck: false,
@@ -145,11 +150,13 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
       playground: true,
     },
     auth: {
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      accessTokenExpiresIn: parse('1h')! / 1000,
-      // eslint-disable-next-line @typescript-eslint/no-non-null-assertion
-      refreshTokenExpiresIn: parse('7d')! / 1000,
-      leeway: 60,
+      session: {
+        ttl: 15 * ONE_DAY_IN_SEC,
+      },
+      accessToken: {
+        ttl: 7 * ONE_DAY_IN_SEC,
+        refreshTokenTtl: 30 * ONE_DAY_IN_SEC,
+      },
       captcha: {
         enable: false,
         turnstile: {
@@ -159,14 +166,6 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
           bits: 20,
         },
       },
-      privateKey: jwtKeyPair.privateKey,
-      publicKey: jwtKeyPair.publicKey,
-      enableSignup: true,
-      enableOauth: false,
-      get nextAuthSecret() {
-        return this.privateKey;
-      },
-      oauthProviders: {},
     },
     storage: getDefaultAFFiNEStorageConfig(),
     rateLimiter: {
@@ -188,10 +187,10 @@ export const getDefaultAFFiNEConfig: () => AFFiNEConfig = () => {
       enabled: false,
     },
     plugins: {
-      enabled: [],
+      enabled: new Set(),
       use(plugin, config) {
         this[plugin] = merge(this[plugin], config || {});
-        this.enabled.push(plugin);
+        this.enabled.add(plugin);
       },
     },
   } satisfies AFFiNEConfig;