Xây nền tảng media với NestJS — Part 2: Xác thực, nginx, rate limit & streaming

npm i argon2 @nestjs/jwt
npm i -D @types/express

import { Injectable } from '@nestjs/common';
import * as argon2 from 'argon2';

@Injectable()
export class PasswordService {
  private readonly options = {
    type: argon2.argon2id,
    memoryCost: 19456, // 19 MiB — moi lan bam ton chung nay RAM
    timeCost: 2,
    parallelism: 1,
  } as const;

  hash(plain: string): Promise<string> {
    return argon2.hash(plain, this.options);
  }

  verify(hash: string, plain: string): Promise<boolean> {
    return argon2.verify(hash, plain);
  }
}

$argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHR2YWx1ZQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG

import { IsEmail, IsString, MinLength } from 'class-validator';

export class LoginDto {
  @IsEmail()
  email!: string;

  @IsString()
  @MinLength(8)
  password!: string;
}

import { ValidationPipe } from '@nestjs/common';
import type { NestExpressApplication } from '@nestjs/platform-express';

const app = await NestFactory.create<NestExpressApplication>(AppModule);
app.useGlobalPipes(
  new ValidationPipe({
    whitelist: true, // xoa nhung field khong khai bao trong DTO thay vi chuyen tiep nguyen si
    forbidNonWhitelisted: true, // co field la khong khai bao -> 400, khong am tham xoa
    transform: true, // "42" tu query string thanh so 42 truoc khi vao ham
  }),
);

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { User } from './user.entity';
import { PasswordService } from './password.service';

// Hash cua mot mat khau khong ai biet. Dung lam moi nhu khi email khong ton tai,
// de thoi gian phan hoi hai truong hop bang nhau.
const DUMMY_HASH =
  '$argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHR2YWx1ZQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG';

@Injectable()
export class AuthService {
  constructor(
    @InjectRepository(User) private readonly users: Repository<User>,
    private readonly passwords: PasswordService,
  ) {}

  private async validateCredentials(email: string, plain: string): Promise<User> {
    const user = await this.users.findOne({ where: { email: email.toLowerCase() } });

    const ok = await this.passwords.verify(user?.passwordHash ?? DUMMY_HASH, plain);

    // Mot thong bao duy nhat cho ca hai truong hop.
    if (!ok || !user) {
      throw new UnauthorizedException('Email hoac mat khau khong dung');
    }

    return user;
  }
}

const configSchema = z.object({
  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
  PORT: z.coerce.number().int().positive().default(3000),
  DATABASE_URL: z.string().url().startsWith('postgres://'),

  // Doi 32 ky tu tro len. Khoa ngan thi chu ky do duoc bang vet can.
  JWT_SECRET: z.string().min(32),
  ACCESS_TOKEN_TTL: z.string().default('15m'),
  REFRESH_TOKEN_TTL_DAYS: z.coerce.number().int().positive().default(30),

  // Dung cho RedisService (gioi han tan suat o muc 5, hang doi o Part 3).
  REDIS_URL: z.string().url().startsWith('redis://').default('redis://localhost:6379'),
});

# Sinh khoa ngau nhien 64 ky tu hex va noi thang vao .env
echo "JWT_SECRET=$(openssl rand -hex 32)" >> .env

# Them not vao .env.example de nguoi khac biet la can bien nay
# (KHONG ghi gia tri that vao file duoc commit)
cat >> .env.example <<'EOF'
JWT_SECRET=thay-bang-chuoi-ngau-nhien-tu-openssl-rand-hex-32
ACCESS_TOKEN_TTL=15m
REFRESH_TOKEN_TTL_DAYS=30
REDIS_URL=redis://localhost:6379
EOF

import { Module } from '@nestjs/common';
import { JwtModule } from '@nestjs/jwt';
import { ConfigService } from '@nestjs/config';
import { TypeOrmModule } from '@nestjs/typeorm';
import type { AppConfig } from '../config/configuration';
import { User } from './user.entity';
import { RefreshToken } from './refresh-token.entity';
import { AuthService } from './auth.service';
import { PasswordService } from './password.service';

@Module({
  imports: [
    TypeOrmModule.forFeature([User, RefreshToken]),
    JwtModule.registerAsync({
      inject: [ConfigService],
      useFactory: (config: ConfigService<AppConfig, true>) => ({
        secret: config.get('JWT_SECRET', { infer: true }),
        signOptions: {
          expiresIn: config.get('ACCESS_TOKEN_TTL', { infer: true }),
          issuer: 'media-forge',
        },
      }),
    }),
  ],
  // Chua co controller nao: file auth.controller.ts duoc viet o muc 3.5,
  // vi chinh no la cho quyet dinh tra refresh token qua cookie hay qua body.
  providers: [AuthService, PasswordService],
  // JwtModule duoc export lai — ProgressGateway o Part 3 tiem JwtService
  // truc tiep de xac thuc bat tay WebSocket, va no nam o mot module khac
  // import AuthModule chu khong phai chinh AuthModule.
  exports: [AuthService, JwtModule],
})
export class AuthModule {}

import type { Request } from 'express';

export const USER_ROLES = ['user', 'admin'] as const;
export type UserRole = (typeof USER_ROLES)[number];

export const USER_PLANS = ['free', 'pro'] as const;
export type UserPlan = (typeof USER_PLANS)[number];

export interface JwtPayload {
  readonly sub: string; // user id — ten chuan trong RFC 7519
  readonly role: UserRole;
  readonly plan: UserPlan; // dung cho gioi han tan suat o muc 5

  readonly iat: number;
  readonly exp: number;
}

// Kieu request sau khi guard da gan nguoi dung vao.
export interface AuthedRequest extends Request {
  readonly user: JwtPayload;
}

import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import type { Request } from 'express';
import type { JwtPayload } from './jwt-payload';

@Injectable()
export class JwtAuthGuard implements CanActivate {
  constructor(private readonly jwt: JwtService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<Request>();
    const header = request.headers.authorization;

    if (header === undefined || !header.startsWith('Bearer ')) {
      throw new UnauthorizedException('Thieu access token');
    }

    try {
      const payload = await this.jwt.verifyAsync<JwtPayload>(header.slice(7));
      // Gan vao request de controller doc duoc.
      Object.defineProperty(request, 'user', { value: payload, enumerable: true });
      return true;
    } catch {
      // Het han, chu ky sai, token bi cat — deu ve mot cho.
      throw new UnauthorizedException('Access token khong hop le');
    }
  }
}

import { createParamDecorator, ExecutionContext } from '@nestjs/common';
import type { AuthedRequest, JwtPayload } from './jwt-payload';

export const CurrentUser = createParamDecorator(
  (_data: unknown, context: ExecutionContext): JwtPayload =>
    context.switchToHttp().getRequest<AuthedRequest>().user,
);

// TRUOC — userId do client gui. Ai cung tieu tien cua ai cung duoc.
@Post('charge')
charge(@Body() dto: ChargeDto) {
  return this.billing.charge(dto.userId, dto.amount, dto.reason);
}

// SAU — userId lay tu chu ky, client khong noi vao duoc.
@Post('charge')
@UseGuards(JwtAuthGuard)
async charge(@CurrentUser() user: JwtPayload, @Body() dto: ChargeDto) {
  await this.billing.charge(user.sub, dto.amount, dto.reason);
  return { balance: await this.billing.getBalance(user.sub) };
}

import { IsIn, IsInt, IsPositive } from 'class-validator';
import type { CreditReason } from './credit-entry.entity';

const CREDIT_REASONS: readonly CreditReason[] = ['topup', 'transcode', 'refund'];

export class ChargeDto {
  @IsInt()
  @IsPositive()
  amount!: number;

  @IsIn(CREDIT_REASONS)
  reason!: CreditReason;
}

import { Body, Controller, Post, UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import type { JwtPayload } from '../auth/jwt-payload';
import { BillingService } from './billing.service';
import { ChargeDto } from './charge.dto';

@Controller('billing')
export class BillingController {
  constructor(private readonly billing: BillingService) {}

  @Post('charge')
  @UseGuards(JwtAuthGuard)
  async charge(@CurrentUser() user: JwtPayload, @Body() dto: ChargeDto): Promise<{ balance: number }> {
    await this.billing.charge(user.sub, dto.amount, dto.reason);
    return { balance: await this.billing.getBalance(user.sub) };
  }
}

import { Module } from '@nestjs/common';
import { TypeOrmModule } from '@nestjs/typeorm';
import { AuthModule } from '../auth/auth.module';
import { CreditEntry } from './credit-entry.entity';
import { BillingController } from './billing.controller';
import { BillingService } from './billing.service';

@Module({
  // AuthModule: JwtAuthGuard tiem JwtService — guard duoc phan giai trong
  // module DUNG no, khong phai module khai no.
  imports: [TypeOrmModule.forFeature([CreditEntry]), AuthModule],
  controllers: [BillingController],
  providers: [BillingService],
  exports: [BillingService],
})
export class BillingModule {}

import { CanActivate, ExecutionContext, ForbiddenException, Injectable, SetMetadata } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import type { AuthedRequest, UserRole } from './jwt-payload';

export const ROLES_KEY = 'roles';
export const Roles = (...roles: readonly UserRole[]) => SetMetadata(ROLES_KEY, roles);

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const required = this.reflector.getAllAndOverride<readonly UserRole[] | undefined>(ROLES_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);

    // Khong khai bao @Roles() thi khong rang buoc vai tro.
    if (required === undefined || required.length === 0) return true;

    const { user } = context.switchToHttp().getRequest<AuthedRequest>();
    if (!required.includes(user.role)) {
      throw new ForbiddenException('Khong du quyen');
    }
    return true;
  }
}

@Get(':userId/balance')
@UseGuards(JwtAuthGuard, RolesGuard)
@Roles('admin')
async getBalanceForUser(@Param('userId') userId: string): Promise<{ balance: number }> {
  return { balance: await this.billing.getBalance(userId) };
}

import { Column, CreateDateColumn, Entity, Index, JoinColumn, ManyToOne, PrimaryGeneratedColumn } from 'typeorm';
import { User } from './user.entity';

@Entity('refresh_tokens')
export class RefreshToken {
  @PrimaryGeneratedColumn('uuid')
  id!: string;

  @ManyToOne(() => User, { onDelete: 'CASCADE' })
  @JoinColumn({ name: 'user_id' })
  user!: User;

  @Column({ name: 'user_id' })
  userId!: string;

  // SHA-256 cua token. Khong bao gio luu ban goc.
  @Index({ unique: true })
  @Column({ name: 'token_hash', length: 64 })
  tokenHash!: string;

  // Ca mot chuoi xoay vong dung chung mot family_id.
  @Index()
  @Column({ name: 'family_id' })
  familyId!: string;

  // null = chua dung. Co gia tri = da dung, dung lai la bao dong.
  @Column({ name: 'used_at', type: 'timestamptz', nullable: true })
  usedAt!: Date | null;

  // Token nao da thay the token nay. Dung cho khoang an han o muc 3.3.
  @Column({ name: 'replaced_by_hash', type: 'varchar', length: 64, nullable: true })
  replacedByHash!: string | null;

  @Column({ name: 'expires_at', type: 'timestamptz' })
  expiresAt!: Date;

  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
  createdAt!: Date;
}

npm run migration:generate -- src/database/migrations/AddReplacedByHash
npm run migration:run

import { randomBytes, createHash, randomUUID } from 'node:crypto';
import type { EntityManager } from 'typeorm';

export interface TokenPair {
  readonly accessToken: string;
  readonly refreshToken: string;
}

private sha256(value: string): string {
  return createHash('sha256').update(value).digest('hex');
}

// manager tuy chon: khi goi tu trong mot transaction dang mo (xoay vong o
// muc 3.3), insert token moi phai dung CHUNG transaction do voi thao tac
// danh dau token cu — dung repo tiem (khong truyen manager) o day se tach
// hai thao tac ra hai ket noi khac nhau, mat tinh nguyen tu cua ca chuoi.
private async issuePair(user: User, familyId: string, manager?: EntityManager): Promise<TokenPair> {
  const accessToken = await this.jwt.signAsync({ sub: user.id, role: user.role, plan: user.plan });

  // 32 byte ngau nhien tu nguon cua he dieu hanh. Khong dung Math.random().
  const refreshToken = randomBytes(32).toString('base64url');
  const days = this.config.get('REFRESH_TOKEN_TTL_DAYS', { infer: true });
  const repo = manager ? manager.getRepository(RefreshToken) : this.refreshTokens;

  await repo.insert({
    userId: user.id,
    tokenHash: this.sha256(refreshToken),
    familyId,
    expiresAt: new Date(Date.now() + days * 24 * 60 * 60 * 1000),
    usedAt: null,
    replacedByHash: null,
  });

  return { accessToken, refreshToken };
}

async login(email: string, plain: string): Promise<TokenPair> {
  const user = await this.validateCredentials(email, plain);
  // Moi lan dang nhap mo mot family moi — tuc la mot thiet bi.
  return this.issuePair(user, randomUUID());
}

async refresh(presented: string): Promise<TokenPair> {
  return this.dataSource.transaction((manager) => this.reissueFrom(manager, this.sha256(presented)));
}

private async reissueFrom(manager: EntityManager, hash: string): Promise<TokenPair> {
  // Khoa dong nay lai. Hai tab cung refresh thi mot cai phai xep hang.
  const row = await manager
    .createQueryBuilder(RefreshToken, 'rt')
    .setLock('pessimistic_write')
    .where('rt.token_hash = :hash', { hash })
    .getOne();

  if (row === null) {
    throw new UnauthorizedException('Refresh token khong hop le');
  }

  // TAI SU DUNG. Ban sao dang ton tai o dau do — dot ca family (xem tiep muc 3.3).
  if (row.usedAt !== null) {
    await manager.delete(RefreshToken, { familyId: row.familyId });
    throw new UnauthorizedException('Phien dang nhap da bi thu hoi');
  }

  if (row.expiresAt.getTime() < Date.now()) {
    throw new UnauthorizedException('Refresh token da het han');
  }

  const user = await manager.findOneOrFail(User, { where: { id: row.userId } });
  const pair = await this.issuePair(user, row.familyId, manager);

  row.usedAt = new Date();
  row.replacedByHash = this.sha256(pair.refreshToken);
  await manager.save(row);

  return pair;
}

const GRACE_MS = 30_000;

if (row.usedAt !== null) {
  const age = Date.now() - row.usedAt.getTime();

  if (age < GRACE_MS && row.replacedByHash !== null) {
    // Gan nhu chac chan la tab thu hai, khong phai ke trom. Di theo con tro
    // replaced_by_hash toi token da thay the token nay, roi xoay tiep tu do.
    return this.reissueFrom(manager, row.replacedByHash);
  }

  await manager.delete(RefreshToken, { familyId: row.familyId });
  throw new UnauthorizedException('Phien dang nhap da bi thu hoi');
}

// Khai bao o pham vi module, canh DUMMY_HASH — khoi code o muc 3.3 phia tren
// da bi ban nay thay tron, nen dong nay phai co mat o day.
const GRACE_MS = 30_000;

async refresh(presented: string): Promise<TokenPair> {
  const hash = this.sha256(presented);
  const result = await this.dataSource.transaction((manager) => this.tryReissue(manager, hash));

  if (result.kind === 'reused') {
    // Repo tiem mo mot giao dich RIENG, doc lap voi giao dich khoa dong da dong o tren.
    await this.refreshTokens.delete({ familyId: result.familyId });
    throw new UnauthorizedException('Phien dang nhap da bi thu hoi');
  }

  return result.pair;
}

private async tryReissue(
  manager: EntityManager,
  hash: string,
): Promise<{ kind: 'ok'; pair: TokenPair } | { kind: 'reused'; familyId: string }> {
  const row = await manager
    .createQueryBuilder(RefreshToken, 'rt')
    .setLock('pessimistic_write')
    .where('rt.token_hash = :hash', { hash })
    .getOne();

  if (row === null) {
    throw new UnauthorizedException('Refresh token khong hop le');
  }

  if (row.usedAt !== null) {
    const age = Date.now() - row.usedAt.getTime();

    if (age < GRACE_MS && row.replacedByHash !== null) {
      return this.tryReissue(manager, row.replacedByHash);
    }

    // KHONG throw o day. Tin hieu ra ngoai de refresh() xu ly sau khi
    // transaction nay da dong — xem ly do o callout ben tren.
    return { kind: 'reused', familyId: row.familyId };
  }

  if (row.expiresAt.getTime() < Date.now()) {
    throw new UnauthorizedException('Refresh token da het han');
  }

  const user = await manager.findOneOrFail(User, { where: { id: row.userId } });
  const pair = await this.issuePair(user, row.familyId, manager);

  row.usedAt = new Date();
  row.replacedByHash = this.sha256(pair.refreshToken);
  await manager.save(row);

  return { kind: 'ok', pair };
}

// Dang xuat thiet bi hien tai: xoa dung family cua token dang cam.
async logout(presented: string): Promise<void> {
  const row = await this.refreshTokens.findOne({
    where: { tokenHash: this.sha256(presented) },
  });
  if (row !== null) {
    await this.refreshTokens.delete({ familyId: row.familyId });
  }
}

// Dang xuat moi noi: dung khi doi mat khau hoac nghi bi lo.
async logoutEverywhere(userId: string): Promise<void> {
  await this.refreshTokens.delete({ userId });
}

constructor(
  @InjectRepository(User) private readonly users: Repository<User>,
  @InjectRepository(RefreshToken) private readonly refreshTokens: Repository<RefreshToken>,
  private readonly passwords: PasswordService,
  private readonly jwt: JwtService,
  private readonly config: ConfigService<AppConfig, true>,
  private readonly dataSource: DataSource,
) {}

response.cookie('refresh_token', refreshToken, {
  httpOnly: true, // JavaScript khong doc duoc — chan XSS lay token
  secure: true, // chi gui qua HTTPS
  sameSite: 'strict', // khong gui kem request tu site khac — chan CSRF
  path: '/auth/refresh', // KHONG dinh vao moi request, chi dinh vao dung endpoint nay
  maxAge: days * 24 * 60 * 60 * 1000,
});

import { IsOptional, IsString } from 'class-validator';

export class RefreshDto {
  // Chi dung khi client khong phai trinh duyet (khong co cookie tu dong).
  @IsOptional()
  @IsString()
  refreshToken?: string;
}

import { Body, Controller, HttpCode, HttpStatus, Post, Req, Res, UnauthorizedException, UseGuards } from '@nestjs/common';
import type { Request, Response } from 'express';
import { ConfigService } from '@nestjs/config';
import { AuthService } from './auth.service';
import { LoginDto } from './login.dto';
import { RefreshDto } from './refresh.dto';
import { JwtAuthGuard } from './jwt-auth.guard';
import { CurrentUser } from './current-user.decorator';
import type { AuthedRequest, JwtPayload } from './jwt-payload';
import type { AppConfig } from '../config/configuration';

const COOKIE_NAME = 'refresh_token';

@Controller('auth')
export class AuthController {
  constructor(
    private readonly auth: AuthService,
    private readonly config: ConfigService<AppConfig, true>,
  ) {}

  @Post('login')
  async login(@Body() dto: LoginDto, @Res({ passthrough: true }) response: Response): Promise<{ accessToken: string }> {
    const pair = await this.auth.login(dto.email, dto.password);
    this.setRefreshCookie(response, pair.refreshToken);
    return { accessToken: pair.accessToken };
  }

  // Doc cookie truoc, khong co thi doc body — dung nhu quyet dinh o muc 3.5.
  @Post('refresh')
  async refresh(
    @Req() request: Request,
    @Body() dto: RefreshDto,
    @Res({ passthrough: true }) response: Response,
  ): Promise<{ accessToken: string }> {
    const presented = this.readPresentedToken(request, dto);
    if (presented === undefined) {
      throw new UnauthorizedException('Thieu refresh token');
    }

    const pair = await this.auth.refresh(presented);
    this.setRefreshCookie(response, pair.refreshToken);
    return { accessToken: pair.accessToken };
  }

  @Post('logout')
  @HttpCode(HttpStatus.NO_CONTENT)
  async logout(@Req() request: Request, @Body() dto: RefreshDto, @Res({ passthrough: true }) response: Response): Promise<void> {
    const presented = this.readPresentedToken(request, dto);
    if (presented !== undefined) {
      await this.auth.logout(presented);
    }
    response.clearCookie(COOKIE_NAME, { path: '/auth/refresh' });
  }

  @Post('logout-everywhere')
  @UseGuards(JwtAuthGuard)
  @HttpCode(HttpStatus.NO_CONTENT)
  async logoutEverywhere(@CurrentUser() user: JwtPayload): Promise<void> {
    await this.auth.logoutEverywhere(user.sub);
  }

  private readPresentedToken(request: Request, dto: RefreshDto): string | undefined {
    return (request as AuthedRequest & Request).cookies?.[COOKIE_NAME] ?? dto.refreshToken;
  }

  private setRefreshCookie(response: Response, refreshToken: string): void {
    const days = this.config.get('REFRESH_TOKEN_TTL_DAYS', { infer: true });

    response.cookie(COOKIE_NAME, refreshToken, {
      httpOnly: true,
      secure: true,
      sameSite: 'strict',
      path: '/auth/refresh',
      maxAge: days * 24 * 60 * 60 * 1000,
    });
  }
}

import { AuthController } from './auth.controller';

@Module({
  imports: [
    /* ... giu nguyen nhu muc 2 ... */
  ],
  controllers: [AuthController],
  providers: [AuthService, PasswordService],
  exports: [AuthService, JwtModule],
})
export class AuthModule {}

import { AuthModule } from './auth/auth.module';

@Module({
  imports: [
    AppConfigModule,
    TypeOrmModule.forRootAsync({
      /* ... nhu Part 1 ... */
    }),
    BillingModule,
    AuthModule,
  ],
})
export class AppModule {}

curl -i -X POST localhost:3000/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"khong-ton-tai@test.local","password":"sai-mat-khau"}'

# Mong doi: HTTP/1.1 401 Unauthorized
#   401 = route CO THAT, DTO qua duoc, service da chay va tu choi dung.
#   404 = chua cam AuthModule vao AppModule, hoac chua them controllers: [...]
#   400 = ValidationPipe chan body, soi lai login.dto.ts

# 1. Dang nhap, lay refresh token tu cookie tra ve
OLD=$(curl -s -i -X POST localhost:3000/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"demo@test.local","password":"matkhau123"}' \
  | sed -n 's/.*refresh_token=\([^;]*\).*/\1/p' | tr -d '\r')

# 2. Xoay vong mot lan -> nhan token moi
NEW=$(curl -s -i -X POST localhost:3000/auth/refresh \
  -H 'Content-Type: application/json' -d "{\"refreshToken\":\"$OLD\"}" \
  | sed -n 's/.*refresh_token=\([^;]*\).*/\1/p' | tr -d '\r')

# 3. PHAI CHO qua 30 giay an han, neu khong buoc 4 tra ve 201 chu khong phai 401
sleep 33

# 4. Dung lai token CU -> bao dong, thu hoi ca family
curl -s -X POST localhost:3000/auth/refresh \
  -H 'Content-Type: application/json' -d "{\"refreshToken\":\"$OLD\"}"
# -> 401 {"message":"Phien dang nhap da bi thu hoi"}

# 5. Token MOI cung chet theo, vi ca family da bi xoa
curl -s -X POST localhost:3000/auth/refresh \
  -H 'Content-Type: application/json' -d "{\"refreshToken\":\"$NEW\"}"
# -> 401 {"message":"Refresh token khong hop le"}

upstream app {
    server app:3000;
    keepalive 32;          # giu ket noi lai, khoi bat tay TCP moi request
}

server {
    listen 443 ssl;
    http2 on;
    server_name media-forge.local;

    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # Mac dinh cua nginx la 1MB. Khong sua thi upload video nao cung 413.
    client_max_body_size 2g;

    # Doc body cham cung khong sao — upload dai la binh thuong.
    client_body_timeout 300s;

    location / {
        proxy_pass http://app;
        proxy_http_version 1.1;

        # Bon dong nay quyet dinh ung dung "nhin thay" client la ai.
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 15s - dung dung ngan sach thoi gian o muc 5.2, khong phai mac dinh cua nginx
        proxy_read_timeout 15s;
    }
}

server {
    listen 80;
    server_name media-forge.local;
    return 301 https://$host$request_uri;
}

mkdir -p docker/certs

# Chung chi tu ky, chi dung o may minh. Tren may chu that thi day la cho
# Let's Encrypt ghi vao, va do la ly do duong dan nam ngoai ung dung.
openssl req -x509 -newkey rsa:2048 -nodes -days 365 \
  -keyout docker/certs/privkey.pem -out docker/certs/fullchain.pem \
  -subj "/CN=media-forge.local" -addext "subjectAltName=DNS:media-forge.local"

services:
  # ... dich vu postgres da chot o Part 1 muc 4.5, giu nguyen ...

  nginx:
    image: nginx:1.27-alpine
    container_name: forge-nginx
    ports:
      - '8080:80'
      - '8443:443'
    volumes:
      - ../nginx/media-forge.conf:/etc/nginx/conf.d/default.conf:ro
      - ./certs:/etc/nginx/certs:ro
    # Cho hostname `app` trong khoi upstream tro ve may that, noi
    # `npm run start:dev` dang chay. Part 3 dong goi ung dung thanh container
    # ten `app` thi bo dong nay di, con file cau hinh khong phai sua mot chu.
    extra_hosts:
      - 'app:host-gateway'

npm run db -- up -d nginx
npm run start:dev            # o mot cua so khac, van chay tren host nhu truoc

# 1. Cong 80 phai day sang HTTPS
curl -s -o /dev/null -w '%{http_code} %{redirect_url}\n' \
  --resolve media-forge.local:8080:127.0.0.1 \
  http://media-forge.local:8080/auth/login
# -> 301 https://media-forge.local/auth/login

# 2. Di xuyen qua nginx toi NestJS. -k vi chung chi tu ky.
curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  -X POST https://media-forge.local:8443/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"demo@test.local","password":"matkhau123"}'
# -> {"accessToken":"eyJhbGciOi..."} — dung request da di qua ca hai tang

# 3. http2 on da co tac dung chua
curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  -o /dev/null -w 'http=%{http_version}\n' https://media-forge.local:8443/
# -> http=2

const app = await NestFactory.create<NestExpressApplication>(AppModule);

// So proxy TIN CAY dung truoc ung dung. Dat dung con so, khong dat true.
app.set('trust proxy', 1);

upstream app {
    server app:3000;
    keepalive 32;
}

# NGU CANH `http` — hai dong nay phai nam NGOAI moi khoi server.
# 10MB bo nho giu duoc khoang 160.000 dia chi IP.
limit_req_zone $binary_remote_addr zone=general:10m rate=30r/s;
limit_req_zone $binary_remote_addr zone=login:10m   rate=5r/m;

server {
    listen 443 ssl;
    http2 on;
    server_name media-forge.local;

    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    client_max_body_size 2g;
    client_body_timeout  300s;

    # DOI CHO so voi muc 4: bon dong header gio dat o muc `server` chu khong
    # trong `location`, nen CA HAI location duoi day deu thua ke chung.
    proxy_http_version 1.1;
    proxy_set_header Host              $host;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 15s;

    location /auth/login {
        limit_req zone=login burst=3 nodelay;
        proxy_pass http://app;
    }

    location / {
        limit_req zone=general burst=60 nodelay;
        proxy_pass http://app;
    }
}

server {
    listen 80;
    server_name media-forge.local;
    return 301 https://$host$request_uri;
}

docker exec forge-nginx nginx -t && docker exec forge-nginx nginx -s reload

# rate=5r/m + burst=3 -> vai request dau lot, phan con lai bi chan ngay tai nginx
for i in $(seq 1 8); do
  curl -sk --resolve media-forge.local:8443:127.0.0.1 -o /dev/null -w '%{http_code} ' \
    -X POST https://media-forge.local:8443/auth/login \
    -H 'Content-Type: application/json' \
    -d '{"email":"demo@test.local","password":"sai"}'
done; echo
# -> 400 400 400 400 503 503 503 503

-- KEYS[1] = khoa cua gao, vi du "rl:user:42"
-- ARGV = suc chua, so token moi giay, thoi diem hien tai (giay), so token can lay
local capacity = tonumber(ARGV[1])
local refill   = tonumber(ARGV[2])
local now      = tonumber(ARGV[3])
local want     = tonumber(ARGV[4])

local bucket = redis.call('HMGET', KEYS[1], 'tokens', 'updated')
local tokens = tonumber(bucket[1]) or capacity
local updated = tonumber(bucket[2]) or now

-- Do day lai theo thoi gian da troi qua, khong vuot suc chua.
tokens = math.min(capacity, tokens + (now - updated) * refill)

local allowed = 0
if tokens >= want then
  tokens = tokens - want
  allowed = 1
end

redis.call('HMSET', KEYS[1], 'tokens', tokens, 'updated', now)
-- Gao day lai hoan toan sau capacity/refill giay thi khong con thong tin gi.
redis.call('EXPIRE', KEYS[1], math.ceil(capacity / refill) * 2)

return { allowed, math.floor(tokens) }

npm i ioredis   # bai nay viet voi ioredis@5

services:
  # ... postgres (Part 1 muc 4.5) va nginx (muc 4) giu nguyen ...

  redis:
    image: redis:7-alpine
    container_name: forge-redis
    ports:
      - '6379:6379'
    healthcheck:
      test: ['CMD', 'redis-cli', 'ping']
      interval: 5s
      timeout: 3s
      retries: 10

npm run db -- up -d redis
docker exec forge-redis redis-cli ping
# -> PONG

import { Injectable, OnModuleDestroy } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import Redis from 'ioredis';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';
import type { AppConfig } from '../config/configuration';

@Injectable()
export class RedisService extends Redis implements OnModuleDestroy {
  constructor(config: ConfigService<AppConfig, true>) {
    super(config.get('REDIS_URL', { infer: true }));

    this.defineCommand('tokenBucket', {
      numberOfKeys: 1,
      lua: readFileSync(join(__dirname, '../common/rate-limit/token-bucket.lua'), 'utf8'),
    });
  }

  // Chu ky khop dung file .lua: capacity, refillPerSecond, now (giay), want.
  // defineCommand gan method nay luc runtime nen TypeScript khong tu suy ra
  // duoc kieu — khai bao tay o day de phan con lai dung kieu that.
  async runTokenBucket(
    key: string,
    capacity: number,
    refillPerSecond: number,
    now: number,
    want: number,
  ): Promise<[allowed: number, remaining: number]> {
    const call = this as unknown as {
      tokenBucket(key: string, capacity: number, refill: number, now: number, want: number): Promise<[number, number]>;
    };
    return call.tokenBucket(key, capacity, refillPerSecond, now, want);
  }

  onModuleDestroy(): void {
    this.disconnect();
  }
}

import { Global, Module } from '@nestjs/common';
import { RedisService } from './redis.service';

// @Global vi gan nhu module nao cung can Redis (rate limit o day, hang doi va
// WebSocket o Part 3) — khai bao mot lan, khoi import lai o khap noi.
@Global()
@Module({
  providers: [RedisService],
  exports: [RedisService],
})
export class RedisModule {}

import { CanActivate, ExecutionContext, HttpException, HttpStatus, Injectable } from '@nestjs/common';
import type { AuthedRequest } from '../../auth/jwt-payload';
import { RedisService } from '../../redis/redis.service';

interface BucketRule {
  readonly capacity: number;
  readonly refillPerSecond: number;
}

const RULES: Readonly<Record<'free' | 'pro', BucketRule>> = {
  free: { capacity: 20, refillPerSecond: 0.2 }, // ~12 request/phut
  pro: { capacity: 200, refillPerSecond: 2 },
};

@Injectable()
export class RateLimitGuard implements CanActivate {
  constructor(private readonly redis: RedisService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<AuthedRequest>();
    const rule = RULES[request.user.plan];

    const [allowed, remaining] = await this.redis.runTokenBucket(
      `rl:user:${request.user.sub}`,
      rule.capacity,
      rule.refillPerSecond,
      Math.floor(Date.now() / 1000),
      1,
    );

    const response = context.switchToHttp().getResponse<{ setHeader: (k: string, v: string) => void }>();
    response.setHeader('X-RateLimit-Remaining', String(remaining));

    if (allowed === 0) {
      // 429 kem Retry-After — client biet cho bao lau thay vi thu lien tuc.
      throw new HttpException(
        { message: 'Vuot han muc, thu lai sau it phut' },
        HttpStatus.TOO_MANY_REQUESTS,
      );
    }
    return true;
  }
}

Truy van database   :  5s   (statement_timeout)
Handler NestJS      : 10s   (interceptor timeout)
proxy_read_timeout  : 15s   (nginx)
Client              : 20s   (fetch + AbortController)

Nguyen tac: tang ngoai LUON dai hon tang trong.
Nguoc lai thi tang ngoai bo cuoc truoc, tang trong van chay — ton tai nguyen
cho mot ket qua khong con ai doi, va nhat ky ghi "thanh cong" cho mot request
ma nguoi dung da thay bao loi.

  // Bat buoc false. Xem canh bao ben duoi.
  synchronize: false,

  // Tang trong cung cua ngan sach thoi gian. Postgres tu huy truy van qua 5s,
  // thay vi de no chay tiep khi khong con ai doi ket qua nua.
  extra: { statement_timeout: 5_000 },

import { CallHandler, ExecutionContext, Injectable, NestInterceptor, RequestTimeoutException } from '@nestjs/common';
import { Observable, TimeoutError, throwError } from 'rxjs';
import { catchError, timeout } from 'rxjs/operators';

// Dai hon statement_timeout (5s) de truy van kip bao loi truoc, va ngan hon
// proxy_read_timeout (15s) de nginx khong bo cuoc truoc ung dung.
const HANDLER_TIMEOUT_MS = 10_000;

@Injectable()
export class TimeoutInterceptor implements NestInterceptor {
  intercept(_context: ExecutionContext, next: CallHandler): Observable<unknown> {
    return next.handle().pipe(
      timeout(HANDLER_TIMEOUT_MS),
      catchError((error: unknown) =>
        throwError(() => (error instanceof TimeoutError ? new RequestTimeoutException() : error)),
      ),
    );
  }
}

app.useGlobalInterceptors(new TimeoutInterceptor());

@Post('upload')
@UseInterceptors(FileInterceptor('file'))
upload(@UploadedFile() file: Express.Multer.File) {
  // file.buffer — CA FILE dang nam trong RAM.
  // 10 nguoi upload 2GB cung luc = 20GB. Tien trinh chet.
  return this.media.save(file.buffer);
}

import { Controller, Post, Req, UseGuards, BadRequestException } from '@nestjs/common';
import { createWriteStream } from 'node:fs';
import { pipeline } from 'node:stream/promises';
import { randomUUID } from 'node:crypto';
import { join } from 'node:path';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { RateLimitGuard } from '../common/rate-limit/rate-limit.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import type { AuthedRequest, JwtPayload } from '../auth/jwt-payload';
import { MediaService } from './media.service';

@Controller('media')
@UseGuards(JwtAuthGuard, RateLimitGuard)
export class UploadController {
  constructor(private readonly media: MediaService) {}

  @Post('upload')
  async upload(
    @Req() request: AuthedRequest,
    @CurrentUser() user: JwtPayload,
  ): Promise<{ videoId: string }> {
    const contentLength = Number(request.headers['content-length'] ?? 0);
    if (contentLength > 2 * 1024 * 1024 * 1024) {
      throw new BadRequestException('File vuot qua 2GB');
    }

    const videoId = randomUUID();
    const target = join(this.media.uploadDir, `${videoId}.bin`);

    // pipeline lo backpressure va don dep khi co loi. Tu goi .pipe()
    // thi phai tu bat 'error' o ca hai dau, quen mot ben la ro file.
    await pipeline(request, createWriteStream(target));

    // Ten file goc di kem qua header rieng — body la bytes thuan tuy, khong
    // phai multipart, nen khong the doc file.name theo cach thuong (xem
    // src/lib/upload.ts o muc 8.2, noi header nay duoc dat tu phia client).
    const originalName = request.headers['x-filename'];
    const decodedName = typeof originalName === 'string' ? decodeURIComponent(originalName) : null;

    const video = await this.media.registerUpload(videoId, user.sub, target, decodedName);
    return { videoId: video.id };
  }
}

import { Injectable, NotFoundException } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { ConfigService } from '@nestjs/config';
import { basename } from 'node:path';
import { Video } from './video.entity';
import type { AppConfig } from '../config/configuration';

export interface PlayableAsset {
  readonly path: string;
  readonly sizeBytes: number;
  readonly storageKey: string;
}

@Injectable()
export class MediaService {
  readonly uploadDir: string;
  readonly tempDir: string;

  constructor(
    @InjectRepository(Video) private readonly videos: Repository<Video>,
    config: ConfigService<AppConfig, true>,
  ) {
    this.uploadDir = config.get('UPLOAD_DIR', { infer: true });
    this.tempDir = config.get('TEMP_UPLOAD_DIR', { infer: true });
  }

  // videoId da duoc UploadController sinh TRUOC khi ghi file (de dat ten file
  // theo id) — luu voi id da co san thay vi de TypeORM tu sinh.
  async registerUpload(
    videoId: string,
    userId: string,
    path: string,
    originalName: string | null,
  ): Promise<Video> {
    return this.videos.save(
      this.videos.create({ id: videoId, userId, originalKey: path, originalName }),
    );
  }

  // Dung boi stream.controller.ts o muc 7. Kiem userId ngay tai day: video
  // khong thuoc ve nguoi goi thi coi nhu khong ton tai, khong tiet lo no co
  // ton tai o dau khac hay khong.
  async findPlayable(id: string, userId: string): Promise<PlayableAsset> {
    const video = await this.videos.findOne({ where: { id, userId } });
    if (video === null) {
      throw new NotFoundException('Khong tim thay video');
    }
    return {
      path: video.originalKey,
      sizeBytes: Number(video.size ?? 0),
      // storageKey la duong dan TUONG DOI ma nginx alias /var/media/ ghep
      // vao — dung khi uploadDir chinh la /var/media (xem docker-compose Part 3).
      storageKey: basename(video.originalKey),
    };
  }
}

UPLOAD_DIR: z.string().default('./uploads'),
TEMP_UPLOAD_DIR: z.string().default('./uploads/tmp'),

mkdir -p uploads/tmp

import { Module } from '@nestjs/common';
import { TypeOrmModule } from '@nestjs/typeorm';
import { Video } from './video.entity';
import { MediaService } from './media.service';
import { UploadController } from './upload.controller';
import { AuthModule } from '../auth/auth.module';

@Module({
  // forFeature: cong bo repository cua Video cho MediaService tiem vao.
  // AuthModule: vi JwtAuthGuard tiem JwtService — guard duoc phan giai trong
  // module DUNG no, khong phai module khai no.
  imports: [TypeOrmModule.forFeature([Video]), AuthModule],
  controllers: [UploadController],
  providers: [MediaService],
  exports: [MediaService],
})
export class MediaModule {}

head -c 838860800 /dev/urandom > /tmp/big.bin      # mot file 800MB

TOK=$(curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  -X POST https://media-forge.local:8443/auth/login \
  -H 'Content-Type: application/json' \
  -d '{"email":"demo@test.local","password":"matkhau123"}' \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["accessToken"])')

PID=$(lsof -ti:3000 | head -1)
ps -o rss= -p $PID                                 # bo nho TRUOC khi upload

curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  -X POST https://media-forge.local:8443/media/upload \
  -H "Authorization: Bearer $TOK" \
  -H 'Content-Type: application/octet-stream' \
  --data-binary @/tmp/big.bin -D- -w '\nhttp=%{http_code}\n'

ps -o rss= -p $PID                                 # va SAU khi upload xong

// TU LAM — bo qua rat nhieu truong hop
request.pipe(createWriteStream(target)); // client ngat giua chung?
                                         // dia day? -> file rac nam lai,
                                         // handle khong dong

// PIPELINE — mot dau hong thi huy ca chuoi, dong sach
await pipeline(request, createWriteStream(target));

import { mkdir, readdir } from 'node:fs/promises';

// Va bo sung `Get` cung `Param` vao dong import @nestjs/common da co san:
// import { Controller, Post, Get, Param, Req, UseGuards, BadRequestException } from '@nestjs/common';

// Client chia file thanh cac manh 5MB va gui lan luot.
@Post('upload/:uploadId/chunk/:index')
async uploadChunk(
  @Param('uploadId') uploadId: string,
  @Param('index') index: string,
  @Req() request: AuthedRequest,
) {
  const target = join(this.media.tempDir, uploadId, `${index}.part`);
  // Thu muc con theo tung uploadId chua tung duoc tao truoc do.
  await mkdir(join(this.media.tempDir, uploadId), { recursive: true });
  await pipeline(request, createWriteStream(target));
  return { received: Number(index) };
}

// Truoc khi gui tiep, client hoi: toi da gui toi dau roi?
@Get('upload/:uploadId/status')
async status(@Param('uploadId') uploadId: string) {
  const parts = await readdir(join(this.media.tempDir, uploadId));
  return { received: parts.map((p) => Number(p.replace('.part', ''))).sort((a, b) => a - b) };
}

import { createReadStream } from 'node:fs';
import { rm } from 'node:fs/promises';

// Client goi endpoint nay khi da gui xong tat ca cac manh.
@Post('upload/:uploadId/complete')
async completeUpload(
  @Param('uploadId') uploadId: string,
  @CurrentUser() user: JwtPayload,
): Promise<{ videoId: string }> {
  const tempPath = join(this.media.tempDir, uploadId);
  const parts = await readdir(tempPath);
  const ordered = parts.map((p) => Number(p.replace('.part', ''))).sort((a, b) => a - b);

  const videoId = randomUUID();
  const target = join(this.media.uploadDir, `${videoId}.bin`);
  const out = createWriteStream(target);

  // MOT writeStream duy nhat cho ca file dich. { end: false } de pipeline
  // khong tu dong voi moi manh, chi dong that su o cuoi vong lap.
  for (const index of ordered) {
    await pipeline(createReadStream(join(tempPath, `${index}.part`)), out, { end: false });
  }
  out.end();

  // Da ghep xong, thu muc chua tung manh khong con can nua.
  await rm(tempPath, { recursive: true, force: true });

  const video = await this.media.registerUpload(videoId, user.sub, target, null);
  return { videoId: video.id };
}

head -c 26214400 /dev/urandom > /tmp/chunky.bin   # 25MB
split -b 5242880 /tmp/chunky.bin /tmp/part-       # thanh 5 manh 5MB
UP=$(uuidgen)

# Gui 3 manh dau roi dung lai — gia lam mat mang
i=0; for f in $(ls /tmp/part-* | head -3); do
  curl -sk --resolve media-forge.local:8443:127.0.0.1 \
    -X POST "https://media-forge.local:8443/media/upload/$UP/chunk/$i" \
    -H "Authorization: Bearer $TOK" -H 'Content-Type: application/octet-stream' \
    --data-binary @$f; i=$((i+1));
done
# -> {"received":0} {"received":1} {"received":2}

# Mo lai trang: toi da gui toi dau roi?
curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  "https://media-forge.local:8443/media/upload/$UP/status" -H "Authorization: Bearer $TOK"
# -> {"received":[0,1,2]}   -> gui tiep tu manh 3

i=3; for f in $(ls /tmp/part-* | tail -2); do
  curl -sk --resolve media-forge.local:8443:127.0.0.1 \
    -X POST "https://media-forge.local:8443/media/upload/$UP/chunk/$i" \
    -H "Authorization: Bearer $TOK" -H 'Content-Type: application/octet-stream' \
    --data-binary @$f; i=$((i+1));
done

curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  -X POST "https://media-forge.local:8443/media/upload/$UP/complete" \
  -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json'
# -> {"videoId":"33003ecf-..."}

# Phep thu that su: file ghep lai co dung tung byte khong?
shasum -a 256 /tmp/chunky.bin
shasum -a 256 uploads/<videoId>.bin
# -> hai chuoi bam GIONG HET nhau

GET /media/abc123/play HTTP/1.1
Range: bytes=52428800-

HTTP/1.1 206 Partial Content
Content-Range: bytes 52428800-104857599/104857600
Content-Length: 52428800
Accept-Ranges: bytes
Content-Type: video/mp4

@Get(':id/play')
@UseGuards(JwtAuthGuard)
async play(
  @Param('id') id: string,
  @CurrentUser() user: JwtPayload,
  @Req() request: Request,
  @Res() response: Response,
): Promise<void> {
  const asset = await this.media.findPlayable(id, user.sub);
  const size = asset.sizeBytes;
  const range = request.headers.range;

  if (range === undefined) {
    response.writeHead(200, { 'Content-Length': size, 'Accept-Ranges': 'bytes' });
    await pipeline(createReadStream(asset.path), response);
    return;
  }

  // "bytes=52428800-" hoac "bytes=0-1023"
  const [rawStart, rawEnd] = range.replace('bytes=', '').split('-');
  const start = Number(rawStart);
  const end = rawEnd === undefined || rawEnd === '' ? size - 1 : Number(rawEnd);

  if (Number.isNaN(start) || start >= size || end >= size) {
    response.writeHead(416, { 'Content-Range': `bytes */${size}` });
    response.end();
    return;
  }

  response.writeHead(206, {
    'Content-Range': `bytes ${start}-${end}/${size}`,
    'Content-Length': end - start + 1,
    'Accept-Ranges': 'bytes',
    'Content-Type': 'video/mp4',
  });

  await pipeline(createReadStream(asset.path, { start, end }), response);
}

location /protected-media/ {
    internal;                 # go thang URL nay tu ngoai vao -> 404
    alias /var/media/;
    sendfile on;
    tcp_nopush on;
}

@Get(':id/play')
@UseGuards(JwtAuthGuard)
async play(
  @Param('id') id: string,
  @CurrentUser() user: JwtPayload,
  @Res() response: Response,
): Promise<void> {
  // Nest van lam phan kho: kiem tra quyen, han muc, trang thai video.
  const asset = await this.media.findPlayable(id, user.sub);

  response.setHeader('X-Accel-Redirect', `/protected-media/${asset.storageKey}`);
  response.setHeader('Content-Type', 'video/mp4');
  response.end(); // Body rong. nginx thay header tren va tu gui file.
}

import { Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { createHmac, timingSafeEqual } from 'node:crypto';
import type { AppConfig } from '../config/configuration';

@Injectable()
export class SignedUrlService {
  constructor(private readonly config: ConfigService<AppConfig, true>) {}

  private get secret(): string {
    return this.config.get('SIGNED_URL_SECRET', { infer: true });
  }

  sign(assetId: string, userId: string, ttlSeconds = 300): string {
    const expires = Math.floor(Date.now() / 1000) + ttlSeconds;
    const payload = `${assetId}:${userId}:${expires}`;
    const signature = createHmac('sha256', this.secret).update(payload).digest('base64url');
    return `/media/${assetId}/play?u=${userId}&e=${expires}&s=${signature}`;
  }

  verify(assetId: string, userId: string, expires: number, signature: string): boolean {
    if (expires < Math.floor(Date.now() / 1000)) return false;

    const expected = createHmac('sha256', this.secret)
      .update(`${assetId}:${userId}:${expires}`)
      .digest('base64url');

    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    // So sanh thoi gian hang so. Dung === thi thoat som o byte dau tien khac nhau,
    // va chenh lech thoi gian do duoc de do dan tung byte cua chu ky.
    return a.length === b.length && timingSafeEqual(a, b);
  }
}

import { Controller, Get, Param, Query, Res, UnauthorizedException, UseGuards } from '@nestjs/common';
import type { Response } from 'express';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import type { JwtPayload } from '../auth/jwt-payload';
import { MediaService } from './media.service';
import { SignedUrlService } from './signed-url.service';

@Controller('media')
export class StreamController {
  constructor(
    private readonly media: MediaService,
    private readonly signedUrl: SignedUrlService,
  ) {}

  // Doi hoi JwtAuthGuard binh thuong: lay URL nay la mot lenh goi tu chinh
  // trang SPA qua fetch/XHR, no gui duoc header Authorization.
  @Get(':id/signed-url')
  @UseGuards(JwtAuthGuard)
  async getSignedUrl(
    @Param('id') id: string,
    @CurrentUser() user: JwtPayload,
  ): Promise<{ url: string }> {
    // Kiem quyen xem NGAY tai day — phat URL cho video khong thuoc ve nguoi
    // goi thi coi nhu tim khong thay, giong het play() ben duoi.
    await this.media.findPlayable(id, user.sub);
    return { url: this.signedUrl.sign(id, user.sub) };
  }

  // KHONG dung JwtAuthGuard — day chinh la route ma URL co chu ky ton tai de
  // phuc vu, vi the <video src="..."> khong gui duoc header Authorization.
  @Get(':id/play')
  async play(
    @Param('id') id: string,
    // Khong co ValidationPipe toan cuc — @Query() khong dam bao gia tri ton
    // tai luc runtime du kieu khai bao la string. Kiem tra tay truoc khi dung.
    @Query('u') userId: string | undefined,
    @Query('e') expires: string | undefined,
    @Query('s') signature: string | undefined,
    @Res() response: Response,
  ): Promise<void> {
    if (
      userId === undefined ||
      expires === undefined ||
      signature === undefined ||
      !this.signedUrl.verify(id, userId, Number(expires), signature)
    ) {
      throw new UnauthorizedException('URL het han hoac khong hop le');
    }

    // Nest van lam phan kho: kiem tra quyen, han muc, trang thai video.
    const asset = await this.media.findPlayable(id, userId);

    response.setHeader('X-Accel-Redirect', `/protected-media/${asset.storageKey}`);
    response.setHeader('Content-Type', 'video/mp4');
    response.end(); // Body rong. nginx thay header tren va tu gui file.
  }
}

// Doc lap voi JWT_SECRET vi khac vong doi: URL nay het han sau vai phut,
// khong phai vai phut sau khi dang xuat.
SIGNED_URL_SECRET: z.string().min(32),

echo "SIGNED_URL_SECRET=$(openssl rand -hex 32)" >> .env
echo "SIGNED_URL_SECRET=thay-bang-chuoi-ngau-nhien-tu-openssl-rand-hex-32" >> .env.example

@Module({
  imports: [TypeOrmModule.forFeature([Video]), AuthModule],
  controllers: [UploadController, StreamController],
  providers: [MediaService, SignedUrlService],
  exports: [MediaService],
})
export class MediaModule {}

VID=<videoId tra ve tu buoc upload o muc 6>

# 1. Xin URL co chu ky (co Authorization, nhu mot lenh fetch tu trang)
URL=$(curl -sk --resolve media-forge.local:8443:127.0.0.1 \
  "https://media-forge.local:8443/media/$VID/signed-url" \
  -H "Authorization: Bearer $TOK" \
  | python3 -c 'import sys,json;print(json.load(sys.stdin)["url"])')

# 2. Phat bang URL do, KHONG kem Authorization — dung nhu the <video> goi
curl -sk --resolve media-forge.local:8443:127.0.0.1 -D- -o /dev/null \
  "https://media-forge.local:8443$URL"
# -> 200, content-length: 26214400, accept-ranges: bytes

# 3. Tua: xin dung 1024 byte tu giua file
curl -sk --resolve media-forge.local:8443:127.0.0.1 -D- -o /dev/null \
  -H 'Range: bytes=10485760-10486783' "https://media-forge.local:8443$URL"
# -> 206, content-range: bytes 10485760-10486783/26214400, content-length: 1024

# 4. Go thang vung noi bo tu ngoai vao
curl -sk --resolve media-forge.local:8443:127.0.0.1 -o /dev/null -w '%{http_code}\n' \
  "https://media-forge.local:8443/protected-media/$VID.bin"
# -> 404   (chi thi `internal` lam dung viec cua no)

# 5. Sua mot ky tu cuoi cua chu ky
curl -sk --resolve media-forge.local:8443:127.0.0.1 -o /dev/null -w '%{http_code}\n' \
  "https://media-forge.local:8443${URL%?}X"
# -> 401

npm create vite@latest media-forge-web -- --template react-ts
cd media-forge-web
npm i
npm i -D tailwindcss @tailwindcss/vite

import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';
import tailwindcss from '@tailwindcss/vite';

export default defineConfig({
  plugins: [react(), tailwindcss()],
});

@import "tailwindcss";

let accessToken: string | null = null;

// Bien then chot: MOT promise refresh dung chung cho ca ung dung.
let refreshing: Promise<void> | null = null;

async function refreshOnce(): Promise<void> {
  // Da co ai dang refresh thi cho ket qua cua ho, khong goi them lan nua.
  refreshing ??= (async () => {
    const res = await fetch('/auth/refresh', { method: 'POST', credentials: 'include' });
    if (!res.ok) throw new Error('Phien dang nhap het hieu luc');
    const data = (await res.json()) as { accessToken: string };
    accessToken = data.accessToken;
  })().finally(() => {
    refreshing = null;
  });

  return refreshing;
}

export async function api(path: string, init: RequestInit = {}): Promise<Response> {
  const call = (): Promise<Response> =>
    fetch(path, {
      ...init,
      credentials: 'include',
      headers: {
        ...init.headers,
        ...(accessToken === null ? {} : { Authorization: `Bearer ${accessToken}` }),
      },
    });

  const first = await call();
  if (first.status !== 401) return first;

  await refreshOnce();
  return call(); // thu lai dung mot lan
}

// Dang nhap: doi email/mat khau lay access token, va giu no trong bien tren.
// Refresh token khong di qua day — server dat no vao cookie httpOnly.
export async function login(email: string, password: string): Promise<void> {
  const res = await fetch('/auth/login', {
    method: 'POST',
    credentials: 'include',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ email, password }),
  });

  if (!res.ok) throw new Error('Email hoac mat khau khong dung');

  const data = (await res.json()) as { accessToken: string };
  accessToken = data.accessToken;
}

export function isLoggedIn(): boolean {
  return accessToken !== null;
}

import { useState, type FormEvent } from 'react';
import { login } from '../lib/api';

export function LoginForm({ onDone }: { onDone: () => void }): JSX.Element {
  const [email, setEmail] = useState('demo@test.local');
  const [password, setPassword] = useState('');
  const [error, setError] = useState<string | null>(null);
  const [busy, setBusy] = useState(false);

  async function handleSubmit(event: FormEvent): Promise<void> {
    event.preventDefault(); // khong de trinh duyet tu nap lai trang
    setBusy(true);
    setError(null);
    try {
      await login(email, password);
      onDone();
    } catch (err) {
      // useUnknownInCatchVariables (Part 1 muc 5) buoc thu hep kieu o day
      setError(err instanceof Error ? err.message : 'Dang nhap that bai');
    } finally {
      setBusy(false);
    }
  }

  return (
    <form onSubmit={handleSubmit} className="mx-auto mt-24 w-80 space-y-3">
      <h1 className="text-lg font-semibold">Đăng nhập</h1>

      <input
        type="email"
        value={email}
        onChange={(e) => setEmail(e.target.value)}
        className="w-full rounded border border-slate-300 px-3 py-2"
      />
      <input
        type="password"
        value={password}
        onChange={(e) => setPassword(e.target.value)}
        placeholder="Mật khẩu"
        className="w-full rounded border border-slate-300 px-3 py-2"
      />

      {error !== null && <p className="text-sm text-red-600">{error}</p>}

      <button
        type="submit"
        disabled={busy}
        className="w-full rounded bg-slate-900 py-2 text-white disabled:opacity-50"
      >
        {busy ? 'Đang gửi…' : 'Đăng nhập'}
      </button>
    </form>
  );
}

import { useState } from 'react';
import { LoginForm } from './components/LoginForm';

export default function App(): JSX.Element {
  const [ready, setReady] = useState(false);

  if (!ready) return <LoginForm onDone={() => setReady(true)} />;

  // Muc 8.2 se thay dong nay bang man upload + trinh phat.
  return <p className="mt-24 text-center">Đã đăng nhập.</p>;
}

export function uploadWithProgress(
  file: File,
  token: string,
  onProgress: (percent: number) => void,
): Promise<{ videoId: string }> {
  return new Promise((resolve, reject) => {
    const xhr = new XMLHttpRequest();
    xhr.open('POST', '/media/upload');
    xhr.setRequestHeader('Authorization', `Bearer ${token}`);
    xhr.setRequestHeader('Content-Type', 'application/octet-stream');
    // Ten file goc di kem qua header rieng, encode de an toan qua HTTP header
    // (xem src/media/upload.controller.ts o muc 6, noi header nay duoc doc lai).
    xhr.setRequestHeader('X-Filename', encodeURIComponent(file.name));

    // upload.onprogress — thu ma fetch khong co.
    xhr.upload.onprogress = (event) => {
      if (event.lengthComputable) {
        onProgress(Math.round((event.loaded / event.total) * 100));
      }
    };

    xhr.onload = () => {
      if (xhr.status >= 200 && xhr.status < 300) {
        resolve(JSON.parse(xhr.responseText) as { videoId: string });
      } else {
        reject(new Error(`Upload that bai: ${xhr.status}`));
      }
    };
    xhr.onerror = () => reject(new Error('Mat ket noi'));

    // Gui thang File. Trinh duyet tu doc theo stream, khong nap het vao RAM.
    xhr.send(file);
  });
}

import { useEffect, useState, type JSX } from 'react';
import { api } from '../lib/api';

export function VideoPlayer({ assetId }: { assetId: string }): JSX.Element {
  const [src, setSrc] = useState<string | null>(null);

  useEffect(() => {
    // The <video> khong gui duoc header Authorization, nen xin URL co chu ky.
    api(`/media/${assetId}/signed-url`)
      .then((res) => res.json() as Promise<{ url: string }>)
      .then((data) => setSrc(data.url));
  }, [assetId]);

  if (src === null) return <div className="h-64 animate-pulse rounded-lg bg-slate-200" />;

  return <video src={src} controls className="w-full rounded-lg shadow-lg" />;
}

// upload.ts can token de dat header Authorization tren XMLHttpRequest —
// XHR khong di qua api() nen phai lay token ra day.
export function getAccessToken(): string | null {
  return accessToken;
}

import { useState, type ChangeEvent, type JSX } from 'react';
import { getAccessToken } from '../lib/api';
import { uploadWithProgress } from '../lib/upload';
import { VideoPlayer } from './VideoPlayer';

export function UploadScreen(): JSX.Element {
  const [percent, setPercent] = useState<number | null>(null);
  const [videoId, setVideoId] = useState<string | null>(null);
  const [error, setError] = useState<string | null>(null);

  async function handleFile(event: ChangeEvent<HTMLInputElement>): Promise<void> {
    const file = event.target.files?.[0];
    const token = getAccessToken();
    if (file === undefined || token === null) return;

    setError(null);
    setVideoId(null);
    setPercent(0);

    try {
      const result = await uploadWithProgress(file, token, setPercent);
      setVideoId(result.videoId);
    } catch (err) {
      setError(err instanceof Error ? err.message : 'Upload that bai');
    } finally {
      setPercent(null);
    }
  }

  return (
    <div className="mx-auto mt-16 w-full max-w-xl space-y-4 px-4">
      <h1 className="text-lg font-semibold">Tải video lên</h1>

      <input type="file" accept="video/*" onChange={handleFile} className="w-full" />

      {percent !== null && (
        <div className="h-2 w-full overflow-hidden rounded bg-slate-200">
          <div className="h-full bg-slate-900 transition-all" style={{ width: `${percent}%` }} />
        </div>
      )}
      {error !== null && <p className="text-sm text-red-600">{error}</p>}

      {videoId !== null && (
        <div className="space-y-2">
          <p className="text-sm text-slate-600">Xong. videoId: {videoId}</p>
          <VideoPlayer assetId={videoId} />
        </div>
      )}
    </div>
  );
}

import { useState, type JSX } from 'react';
import { LoginForm } from './components/LoginForm';
import { UploadScreen } from './components/UploadScreen';

export default function App(): JSX.Element {
  const [ready, setReady] = useState(false);

  if (!ready) return <LoginForm onDone={() => setReady(true)} />;

  return <UploadScreen />;
}

import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';
import tailwindcss from '@tailwindcss/vite';

const gateway = {
  target: 'https://127.0.0.1:8443',
  secure: false, // chung chi tu ky o muc 4
  // nginx khop server_name media-forge.local — dat Host o day de khoi
  // phai them mot dong vao /etc/hosts.
  headers: { Host: 'media-forge.local' },
};

export default defineConfig({
  plugins: [react(), tailwindcss()],
  server: {
    proxy: {
      '/auth': gateway,
      '/media': gateway,
    },
  },
});