Xây nền tảng media với NestJS — Part 2: Xác thực, nginx, rate limit & streaming

npm i argon2 @nestjs/jwt
npm i -D @types/express

import { Injectable } from '@nestjs/common';
import * as argon2 from 'argon2';

@Injectable()
export class PasswordService {
  private readonly options = {
    type: argon2.argon2id,
    memoryCost: 19456, // 19 MiB — moi lan bam ton chung nay RAM
    timeCost: 2,
    parallelism: 1,
  } as const;

  hash(plain: string): Promise<string> {
    return argon2.hash(plain, this.options);
  }

  verify(hash: string, plain: string): Promise<boolean> {
    return argon2.verify(hash, plain);
  }
}

$argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHR2YWx1ZQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG

import { IsEmail, IsString, MinLength } from 'class-validator';

export class LoginDto {
  @IsEmail()
  email!: string;

  @IsString()
  @MinLength(8)
  password!: string;
}

import { ValidationPipe } from '@nestjs/common';

const app = await NestFactory.create<NestExpressApplication>(AppModule);
app.useGlobalPipes(
  new ValidationPipe({
    whitelist: true, // xoa nhung field khong khai bao trong DTO thay vi chuyen tiep nguyen si
    forbidNonWhitelisted: true, // co field la khong khai bao -> 400, khong am tham xoa
    transform: true, // "42" tu query string thanh so 42 truoc khi vao ham
  }),
);

import { Injectable, UnauthorizedException } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { User } from './user.entity';
import { PasswordService } from './password.service';

// Hash cua mot mat khau khong ai biet. Dung lam moi nhu khi email khong ton tai,
// de thoi gian phan hoi hai truong hop bang nhau.
const DUMMY_HASH =
  '$argon2id$v=19$m=19456,t=2,p=1$c29tZXNhbHR2YWx1ZQ$RdescudvJCsgt3ub+b+dWRWJTmaaJObG';

@Injectable()
export class AuthService {
  constructor(
    @InjectRepository(User) private readonly users: Repository<User>,
    private readonly passwords: PasswordService,
  ) {}

  private async validateCredentials(email: string, plain: string): Promise<User> {
    const user = await this.users.findOne({ where: { email: email.toLowerCase() } });

    const ok = await this.passwords.verify(user?.passwordHash ?? DUMMY_HASH, plain);

    // Mot thong bao duy nhat cho ca hai truong hop.
    if (!ok || !user) {
      throw new UnauthorizedException('Email hoac mat khau khong dung');
    }

    return user;
  }
}

const configSchema = z.object({
  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
  PORT: z.coerce.number().int().positive().default(3000),
  DATABASE_URL: z.string().url().startsWith('postgres://'),

  // Doi 32 ky tu tro len. Khoa ngan thi chu ky do duoc bang vet can.
  JWT_SECRET: z.string().min(32),
  ACCESS_TOKEN_TTL: z.string().default('15m'),
  REFRESH_TOKEN_TTL_DAYS: z.coerce.number().int().positive().default(30),

  // Dung cho RedisService (gioi han tan suat o muc 5, hang doi o Part 3).
  REDIS_URL: z.string().url().startsWith('redis://').default('redis://localhost:6379'),
});

import { Module } from '@nestjs/common';
import { JwtModule } from '@nestjs/jwt';
import { ConfigService } from '@nestjs/config';
import { TypeOrmModule } from '@nestjs/typeorm';
import type { AppConfig } from '../config/configuration';
import { User } from './user.entity';
import { RefreshToken } from './refresh-token.entity';
import { AuthService } from './auth.service';
import { PasswordService } from './password.service';
import { AuthController } from './auth.controller';

@Module({
  imports: [
    TypeOrmModule.forFeature([User, RefreshToken]),
    JwtModule.registerAsync({
      inject: [ConfigService],
      useFactory: (config: ConfigService<AppConfig, true>) => ({
        secret: config.get('JWT_SECRET', { infer: true }),
        signOptions: {
          expiresIn: config.get('ACCESS_TOKEN_TTL', { infer: true }),
          issuer: 'media-forge',
        },
      }),
    }),
  ],
  controllers: [AuthController],
  providers: [AuthService, PasswordService],
  // JwtModule duoc export lai — ProgressGateway o Part 3 tiem JwtService
  // truc tiep de xac thuc bat tay WebSocket, va no nam o mot module khac
  // import AuthModule chu khong phai chinh AuthModule.
  exports: [AuthService, JwtModule],
})
export class AuthModule {}

import type { Request } from 'express';

export const USER_ROLES = ['user', 'admin'] as const;
export type UserRole = (typeof USER_ROLES)[number];

export const USER_PLANS = ['free', 'pro'] as const;
export type UserPlan = (typeof USER_PLANS)[number];

export interface JwtPayload {
  readonly sub: string; // user id — ten chuan trong RFC 7519
  readonly role: UserRole;
  readonly plan: UserPlan; // dung cho gioi han tan suat o muc 5

  readonly iat: number;
  readonly exp: number;
}

// Kieu request sau khi guard da gan nguoi dung vao.
export interface AuthedRequest extends Request {
  readonly user: JwtPayload;
}

import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common';
import { JwtService } from '@nestjs/jwt';
import type { Request } from 'express';
import type { JwtPayload } from './jwt-payload';

@Injectable()
export class JwtAuthGuard implements CanActivate {
  constructor(private readonly jwt: JwtService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<Request>();
    const header = request.headers.authorization;

    if (header === undefined || !header.startsWith('Bearer ')) {
      throw new UnauthorizedException('Thieu access token');
    }

    try {
      const payload = await this.jwt.verifyAsync<JwtPayload>(header.slice(7));
      // Gan vao request de controller doc duoc.
      Object.defineProperty(request, 'user', { value: payload, enumerable: true });
      return true;
    } catch {
      // Het han, chu ky sai, token bi cat — deu ve mot cho.
      throw new UnauthorizedException('Access token khong hop le');
    }
  }
}

import { createParamDecorator, ExecutionContext } from '@nestjs/common';
import type { AuthedRequest, JwtPayload } from './jwt-payload';

export const CurrentUser = createParamDecorator(
  (_data: unknown, context: ExecutionContext): JwtPayload =>
    context.switchToHttp().getRequest<AuthedRequest>().user,
);

// TRUOC — userId do client gui. Ai cung tieu tien cua ai cung duoc.
@Post('charge')
charge(@Body() dto: ChargeDto) {
  return this.billing.charge(dto.userId, dto.amount, dto.reason);
}

// SAU — userId lay tu chu ky, client khong noi vao duoc.
@Post('charge')
@UseGuards(JwtAuthGuard)
async charge(@CurrentUser() user: JwtPayload, @Body() dto: ChargeDto) {
  await this.billing.charge(user.sub, dto.amount, dto.reason);
  return { balance: await this.billing.getBalance(user.sub) };
}

import { IsIn, IsInt, IsPositive } from 'class-validator';
import type { CreditReason } from './credit-entry.entity';

const CREDIT_REASONS: readonly CreditReason[] = ['topup', 'transcode', 'refund'];

export class ChargeDto {
  @IsInt()
  @IsPositive()
  amount!: number;

  @IsIn(CREDIT_REASONS)
  reason!: CreditReason;
}

import { Body, Controller, Post, UseGuards } from '@nestjs/common';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import type { JwtPayload } from '../auth/jwt-payload';
import { BillingService } from './billing.service';
import { ChargeDto } from './charge.dto';

@Controller('billing')
export class BillingController {
  constructor(private readonly billing: BillingService) {}

  @Post('charge')
  @UseGuards(JwtAuthGuard)
  async charge(@CurrentUser() user: JwtPayload, @Body() dto: ChargeDto): Promise<{ balance: number }> {
    await this.billing.charge(user.sub, dto.amount, dto.reason);
    return { balance: await this.billing.getBalance(user.sub) };
  }
}

import { CanActivate, ExecutionContext, ForbiddenException, Injectable, SetMetadata } from '@nestjs/common';
import { Reflector } from '@nestjs/core';
import type { AuthedRequest, UserRole } from './jwt-payload';

export const ROLES_KEY = 'roles';
export const Roles = (...roles: readonly UserRole[]) => SetMetadata(ROLES_KEY, roles);

@Injectable()
export class RolesGuard implements CanActivate {
  constructor(private readonly reflector: Reflector) {}

  canActivate(context: ExecutionContext): boolean {
    const required = this.reflector.getAllAndOverride<readonly UserRole[] | undefined>(ROLES_KEY, [
      context.getHandler(),
      context.getClass(),
    ]);

    // Khong khai bao @Roles() thi khong rang buoc vai tro.
    if (required === undefined || required.length === 0) return true;

    const { user } = context.switchToHttp().getRequest<AuthedRequest>();
    if (!required.includes(user.role)) {
      throw new ForbiddenException('Khong du quyen');
    }
    return true;
  }
}

@Get(':userId/balance')
@UseGuards(JwtAuthGuard, RolesGuard)
@Roles('admin')
async getBalanceForUser(@Param('userId') userId: string): Promise<{ balance: number }> {
  return { balance: await this.billing.getBalance(userId) };
}

import { Column, CreateDateColumn, Entity, Index, JoinColumn, ManyToOne, PrimaryGeneratedColumn } from 'typeorm';
import { User } from './user.entity';

@Entity('refresh_tokens')
export class RefreshToken {
  @PrimaryGeneratedColumn('uuid')
  id!: string;

  @ManyToOne(() => User, { onDelete: 'CASCADE' })
  @JoinColumn({ name: 'user_id' })
  user!: User;

  @Column({ name: 'user_id' })
  userId!: string;

  // SHA-256 cua token. Khong bao gio luu ban goc.
  @Index({ unique: true })
  @Column({ name: 'token_hash', length: 64 })
  tokenHash!: string;

  // Ca mot chuoi xoay vong dung chung mot family_id.
  @Index()
  @Column({ name: 'family_id' })
  familyId!: string;

  // null = chua dung. Co gia tri = da dung, dung lai la bao dong.
  @Column({ name: 'used_at', type: 'timestamptz', nullable: true })
  usedAt!: Date | null;

  // Token nao da thay the token nay. Dung cho khoang an han o muc 3.3.
  @Column({ name: 'replaced_by_hash', type: 'varchar', length: 64, nullable: true })
  replacedByHash!: string | null;

  @Column({ name: 'expires_at', type: 'timestamptz' })
  expiresAt!: Date;

  @CreateDateColumn({ name: 'created_at', type: 'timestamptz' })
  createdAt!: Date;
}

import { randomBytes, createHash, randomUUID } from 'node:crypto';
import type { EntityManager } from 'typeorm';

export interface TokenPair {
  readonly accessToken: string;
  readonly refreshToken: string;
}

private sha256(value: string): string {
  return createHash('sha256').update(value).digest('hex');
}

// manager tuy chon: khi goi tu trong mot transaction dang mo (xoay vong o
// muc 3.3), insert token moi phai dung CHUNG transaction do voi thao tac
// danh dau token cu — dung repo tiem (khong truyen manager) o day se tach
// hai thao tac ra hai ket noi khac nhau, mat tinh nguyen tu cua ca chuoi.
private async issuePair(user: User, familyId: string, manager?: EntityManager): Promise<TokenPair> {
  const accessToken = await this.jwt.signAsync({ sub: user.id, role: user.role, plan: user.plan });

  // 32 byte ngau nhien tu nguon cua he dieu hanh. Khong dung Math.random().
  const refreshToken = randomBytes(32).toString('base64url');
  const days = this.config.get('REFRESH_TOKEN_TTL_DAYS', { infer: true });
  const repo = manager ? manager.getRepository(RefreshToken) : this.refreshTokens;

  await repo.insert({
    userId: user.id,
    tokenHash: this.sha256(refreshToken),
    familyId,
    expiresAt: new Date(Date.now() + days * 24 * 60 * 60 * 1000),
    usedAt: null,
    replacedByHash: null,
  });

  return { accessToken, refreshToken };
}

async login(email: string, plain: string): Promise<TokenPair> {
  const user = await this.validateCredentials(email, plain);
  // Moi lan dang nhap mo mot family moi — tuc la mot thiet bi.
  return this.issuePair(user, randomUUID());
}

async refresh(presented: string): Promise<TokenPair> {
  return this.dataSource.transaction((manager) => this.reissueFrom(manager, this.sha256(presented)));
}

private async reissueFrom(manager: EntityManager, hash: string): Promise<TokenPair> {
  // Khoa dong nay lai. Hai tab cung refresh thi mot cai phai xep hang.
  const row = await manager
    .createQueryBuilder(RefreshToken, 'rt')
    .setLock('pessimistic_write')
    .where('rt.token_hash = :hash', { hash })
    .getOne();

  if (row === null) {
    throw new UnauthorizedException('Refresh token khong hop le');
  }

  // TAI SU DUNG. Ban sao dang ton tai o dau do — dot ca family (xem tiep muc 3.3).
  if (row.usedAt !== null) {
    await manager.delete(RefreshToken, { familyId: row.familyId });
    throw new UnauthorizedException('Phien dang nhap da bi thu hoi');
  }

  if (row.expiresAt.getTime() < Date.now()) {
    throw new UnauthorizedException('Refresh token da het han');
  }

  const user = await manager.findOneOrFail(User, { where: { id: row.userId } });
  const pair = await this.issuePair(user, row.familyId, manager);

  row.usedAt = new Date();
  row.replacedByHash = this.sha256(pair.refreshToken);
  await manager.save(row);

  return pair;
}

const GRACE_MS = 30_000;

if (row.usedAt !== null) {
  const age = Date.now() - row.usedAt.getTime();

  if (age < GRACE_MS && row.replacedByHash !== null) {
    // Gan nhu chac chan la tab thu hai, khong phai ke trom.
    // Tra lai dung token da phat cho tab thu nhat.
    return this.reissueFrom(manager, row.replacedByHash);
  }

  await manager.delete(RefreshToken, { familyId: row.familyId });
  throw new UnauthorizedException('Phien dang nhap da bi thu hoi');
}

async refresh(presented: string): Promise<TokenPair> {
  const hash = this.sha256(presented);
  const result = await this.dataSource.transaction((manager) => this.tryReissue(manager, hash));

  if (result.kind === 'reused') {
    // Repo tiem mo mot giao dich RIENG, doc lap voi giao dich khoa dong da dong o tren.
    await this.refreshTokens.delete({ familyId: result.familyId });
    throw new UnauthorizedException('Phien dang nhap da bi thu hoi');
  }

  return result.pair;
}

private async tryReissue(
  manager: EntityManager,
  hash: string,
): Promise<{ kind: 'ok'; pair: TokenPair } | { kind: 'reused'; familyId: string }> {
  const row = await manager
    .createQueryBuilder(RefreshToken, 'rt')
    .setLock('pessimistic_write')
    .where('rt.token_hash = :hash', { hash })
    .getOne();

  if (row === null) {
    throw new UnauthorizedException('Refresh token khong hop le');
  }

  if (row.usedAt !== null) {
    const age = Date.now() - row.usedAt.getTime();

    if (age < GRACE_MS && row.replacedByHash !== null) {
      return this.tryReissue(manager, row.replacedByHash);
    }

    // KHONG throw o day. Tin hieu ra ngoai de refresh() xu ly sau khi
    // transaction nay da dong — xem ly do o callout ben tren.
    return { kind: 'reused', familyId: row.familyId };
  }

  if (row.expiresAt.getTime() < Date.now()) {
    throw new UnauthorizedException('Refresh token da het han');
  }

  const user = await manager.findOneOrFail(User, { where: { id: row.userId } });
  const pair = await this.issuePair(user, row.familyId, manager);

  row.usedAt = new Date();
  row.replacedByHash = this.sha256(pair.refreshToken);
  await manager.save(row);

  return { kind: 'ok', pair };
}

// Dang xuat thiet bi hien tai: xoa dung family cua token dang cam.
async logout(presented: string): Promise<void> {
  const row = await this.refreshTokens.findOne({
    where: { tokenHash: this.sha256(presented) },
  });
  if (row !== null) {
    await this.refreshTokens.delete({ familyId: row.familyId });
  }
}

// Dang xuat moi noi: dung khi doi mat khau hoac nghi bi lo.
async logoutEverywhere(userId: string): Promise<void> {
  await this.refreshTokens.delete({ userId });
}

constructor(
  @InjectRepository(User) private readonly users: Repository<User>,
  @InjectRepository(RefreshToken) private readonly refreshTokens: Repository<RefreshToken>,
  private readonly passwords: PasswordService,
  private readonly jwt: JwtService,
  private readonly config: ConfigService<AppConfig, true>,
  private readonly dataSource: DataSource,
) {}

response.cookie('refresh_token', refreshToken, {
  httpOnly: true, // JavaScript khong doc duoc — chan XSS lay token
  secure: true, // chi gui qua HTTPS
  sameSite: 'strict', // khong gui kem request tu site khac — chan CSRF
  path: '/auth/refresh', // KHONG dinh vao moi request, chi dinh vao dung endpoint nay
  maxAge: days * 24 * 60 * 60 * 1000,
});

import { IsOptional, IsString } from 'class-validator';

export class RefreshDto {
  // Chi dung khi client khong phai trinh duyet (khong co cookie tu dong).
  @IsOptional()
  @IsString()
  refreshToken?: string;
}

import { Body, Controller, HttpCode, HttpStatus, Post, Req, Res, UnauthorizedException, UseGuards } from '@nestjs/common';
import type { Request, Response } from 'express';
import { ConfigService } from '@nestjs/config';
import { AuthService } from './auth.service';
import { LoginDto } from './login.dto';
import { RefreshDto } from './refresh.dto';
import { JwtAuthGuard } from './jwt-auth.guard';
import { CurrentUser } from './current-user.decorator';
import type { AuthedRequest, JwtPayload } from './jwt-payload';
import type { AppConfig } from '../config/configuration';

const COOKIE_NAME = 'refresh_token';

@Controller('auth')
export class AuthController {
  constructor(
    private readonly auth: AuthService,
    private readonly config: ConfigService<AppConfig, true>,
  ) {}

  @Post('login')
  async login(@Body() dto: LoginDto, @Res({ passthrough: true }) response: Response): Promise<{ accessToken: string }> {
    const pair = await this.auth.login(dto.email, dto.password);
    this.setRefreshCookie(response, pair.refreshToken);
    return { accessToken: pair.accessToken };
  }

  // Doc cookie truoc, khong co thi doc body — dung nhu quyet dinh o muc 3.5.
  @Post('refresh')
  async refresh(
    @Req() request: Request,
    @Body() dto: RefreshDto,
    @Res({ passthrough: true }) response: Response,
  ): Promise<{ accessToken: string }> {
    const presented = this.readPresentedToken(request, dto);
    if (presented === undefined) {
      throw new UnauthorizedException('Thieu refresh token');
    }

    const pair = await this.auth.refresh(presented);
    this.setRefreshCookie(response, pair.refreshToken);
    return { accessToken: pair.accessToken };
  }

  @Post('logout')
  @HttpCode(HttpStatus.NO_CONTENT)
  async logout(@Req() request: Request, @Body() dto: RefreshDto, @Res({ passthrough: true }) response: Response): Promise<void> {
    const presented = this.readPresentedToken(request, dto);
    if (presented !== undefined) {
      await this.auth.logout(presented);
    }
    response.clearCookie(COOKIE_NAME, { path: '/auth/refresh' });
  }

  @Post('logout-everywhere')
  @UseGuards(JwtAuthGuard)
  @HttpCode(HttpStatus.NO_CONTENT)
  async logoutEverywhere(@CurrentUser() user: JwtPayload): Promise<void> {
    await this.auth.logoutEverywhere(user.sub);
  }

  private readPresentedToken(request: Request, dto: RefreshDto): string | undefined {
    return (request as AuthedRequest & Request).cookies?.[COOKIE_NAME] ?? dto.refreshToken;
  }

  private setRefreshCookie(response: Response, refreshToken: string): void {
    const days = this.config.get('REFRESH_TOKEN_TTL_DAYS', { infer: true });

    response.cookie(COOKIE_NAME, refreshToken, {
      httpOnly: true,
      secure: true,
      sameSite: 'strict',
      path: '/auth/refresh',
      maxAge: days * 24 * 60 * 60 * 1000,
    });
  }
}

upstream app {
    server app:3000;
    keepalive 32;          # giu ket noi lai, khoi bat tay TCP moi request
}

server {
    listen 443 ssl;
    http2 on;
    server_name media-forge.local;

    ssl_certificate     /etc/nginx/certs/fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/privkey.pem;
    ssl_protocols       TLSv1.2 TLSv1.3;

    # Mac dinh cua nginx la 1MB. Khong sua thi upload video nao cung 413.
    client_max_body_size 2g;

    # Doc body cham cung khong sao — upload dai la binh thuong.
    client_body_timeout 300s;

    location / {
        proxy_pass http://app;
        proxy_http_version 1.1;

        # Bon dong nay quyet dinh ung dung "nhin thay" client la ai.
        proxy_set_header Host              $host;
        proxy_set_header X-Real-IP         $remote_addr;
        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # 15s - dung dung ngan sach thoi gian o muc 5.2, khong phai mac dinh cua nginx
        proxy_read_timeout 15s;
    }
}

server {
    listen 80;
    server_name media-forge.local;
    return 301 https://$host$request_uri;
}

const app = await NestFactory.create<NestExpressApplication>(AppModule);

// So proxy TIN CAY dung truoc ung dung. Dat dung con so, khong dat true.
app.set('trust proxy', 1);

# 10MB bo nho giu duoc khoang 160.000 dia chi IP.
limit_req_zone $binary_remote_addr zone=general:10m rate=30r/s;
limit_req_zone $binary_remote_addr zone=login:10m   rate=5r/m;

location /auth/login {
    limit_req zone=login burst=3 nodelay;
    proxy_pass http://app;
}

location / {
    limit_req zone=general burst=60 nodelay;
    proxy_pass http://app;
}

-- KEYS[1] = khoa cua gao, vi du "rl:user:42"
-- ARGV = suc chua, so token moi giay, thoi diem hien tai (giay), so token can lay
local capacity = tonumber(ARGV[1])
local refill   = tonumber(ARGV[2])
local now      = tonumber(ARGV[3])
local want     = tonumber(ARGV[4])

local bucket = redis.call('HMGET', KEYS[1], 'tokens', 'updated')
local tokens = tonumber(bucket[1]) or capacity
local updated = tonumber(bucket[2]) or now

-- Do day lai theo thoi gian da troi qua, khong vuot suc chua.
tokens = math.min(capacity, tokens + (now - updated) * refill)

local allowed = 0
if tokens >= want then
  tokens = tokens - want
  allowed = 1
end

redis.call('HMSET', KEYS[1], 'tokens', tokens, 'updated', now)
-- Gao day lai hoan toan sau capacity/refill giay thi khong con thong tin gi.
redis.call('EXPIRE', KEYS[1], math.ceil(capacity / refill) * 2)

return { allowed, math.floor(tokens) }

import { Injectable, OnModuleDestroy } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import Redis from 'ioredis';
import { readFileSync } from 'node:fs';
import { join } from 'node:path';
import type { AppConfig } from '../config/configuration';

@Injectable()
export class RedisService extends Redis implements OnModuleDestroy {
  constructor(config: ConfigService<AppConfig, true>) {
    super(config.get('REDIS_URL', { infer: true }));

    this.defineCommand('tokenBucket', {
      numberOfKeys: 1,
      lua: readFileSync(join(__dirname, '../common/rate-limit/token-bucket.lua'), 'utf8'),
    });
  }

  // Chu ky khop dung file .lua: capacity, refillPerSecond, now (giay), want.
  // defineCommand gan method nay luc runtime nen TypeScript khong tu suy ra
  // duoc kieu — khai bao tay o day de phan con lai dung kieu that.
  async runTokenBucket(
    key: string,
    capacity: number,
    refillPerSecond: number,
    now: number,
    want: number,
  ): Promise<[allowed: number, remaining: number]> {
    const call = this as unknown as {
      tokenBucket(key: string, capacity: number, refill: number, now: number, want: number): Promise<[number, number]>;
    };
    return call.tokenBucket(key, capacity, refillPerSecond, now, want);
  }

  onModuleDestroy(): void {
    this.disconnect();
  }
}

import { CanActivate, ExecutionContext, HttpException, HttpStatus, Injectable } from '@nestjs/common';
import type { AuthedRequest } from '../../auth/jwt-payload';
import { RedisService } from '../../redis/redis.service';

interface BucketRule {
  readonly capacity: number;
  readonly refillPerSecond: number;
}

const RULES: Readonly<Record<'free' | 'pro', BucketRule>> = {
  free: { capacity: 20, refillPerSecond: 0.2 }, // ~12 request/phut
  pro: { capacity: 200, refillPerSecond: 2 },
};

@Injectable()
export class RateLimitGuard implements CanActivate {
  constructor(private readonly redis: RedisService) {}

  async canActivate(context: ExecutionContext): Promise<boolean> {
    const request = context.switchToHttp().getRequest<AuthedRequest>();
    const rule = RULES[request.user.plan];

    const [allowed, remaining] = await this.redis.runTokenBucket(
      `rl:user:${request.user.sub}`,
      rule.capacity,
      rule.refillPerSecond,
      Math.floor(Date.now() / 1000),
      1,
    );

    const response = context.switchToHttp().getResponse<{ setHeader: (k: string, v: string) => void }>();
    response.setHeader('X-RateLimit-Remaining', String(remaining));

    if (allowed === 0) {
      // 429 kem Retry-After — client biet cho bao lau thay vi thu lien tuc.
      throw new HttpException(
        { message: 'Vuot han muc, thu lai sau it phut' },
        HttpStatus.TOO_MANY_REQUESTS,
      );
    }
    return true;
  }
}

Truy van database   :  5s   (statement_timeout)
Handler NestJS      : 10s   (interceptor timeout)
proxy_read_timeout  : 15s   (nginx)
Client              : 20s   (fetch + AbortController)

Nguyen tac: tang ngoai LUON dai hon tang trong.
Nguoc lai thi tang ngoai bo cuoc truoc, tang trong van chay — ton tai nguyen
cho mot ket qua khong con ai doi, va nhat ky ghi "thanh cong" cho mot request
ma nguoi dung da thay bao loi.

@Post('upload')
@UseInterceptors(FileInterceptor('file'))
upload(@UploadedFile() file: Express.Multer.File) {
  // file.buffer — CA FILE dang nam trong RAM.
  // 10 nguoi upload 2GB cung luc = 20GB. Tien trinh chet.
  return this.media.save(file.buffer);
}

import { Controller, Post, Req, UseGuards, BadRequestException } from '@nestjs/common';
import { createWriteStream } from 'node:fs';
import { pipeline } from 'node:stream/promises';
import { randomUUID } from 'node:crypto';
import { join } from 'node:path';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { RateLimitGuard } from '../common/rate-limit/rate-limit.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import type { AuthedRequest, JwtPayload } from '../auth/jwt-payload';
import { MediaService } from './media.service';

@Controller('media')
@UseGuards(JwtAuthGuard, RateLimitGuard)
export class UploadController {
  constructor(private readonly media: MediaService) {}

  @Post('upload')
  async upload(
    @Req() request: AuthedRequest,
    @CurrentUser() user: JwtPayload,
  ): Promise<{ videoId: string }> {
    const contentLength = Number(request.headers['content-length'] ?? 0);
    if (contentLength > 2 * 1024 * 1024 * 1024) {
      throw new BadRequestException('File vuot qua 2GB');
    }

    const videoId = randomUUID();
    const target = join(this.media.uploadDir, `${videoId}.bin`);

    // pipeline lo backpressure va don dep khi co loi. Tu goi .pipe()
    // thi phai tu bat 'error' o ca hai dau, quen mot ben la ro file.
    await pipeline(request, createWriteStream(target));

    // Ten file goc di kem qua header rieng — body la bytes thuan tuy, khong
    // phai multipart, nen khong the doc file.name theo cach thuong (xem
    // src/lib/upload.ts o muc 8.2, noi header nay duoc dat tu phia client).
    const originalName = request.headers['x-filename'];
    const decodedName = typeof originalName === 'string' ? decodeURIComponent(originalName) : null;

    const video = await this.media.registerUpload(videoId, user.sub, target, decodedName);
    return { videoId: video.id };
  }
}

import { Injectable, NotFoundException } from '@nestjs/common';
import { InjectRepository } from '@nestjs/typeorm';
import { Repository } from 'typeorm';
import { ConfigService } from '@nestjs/config';
import { basename } from 'node:path';
import { Video } from './video.entity';
import type { AppConfig } from '../config/configuration';

export interface PlayableAsset {
  readonly path: string;
  readonly sizeBytes: number;
  readonly storageKey: string;
}

@Injectable()
export class MediaService {
  readonly uploadDir: string;
  readonly tempDir: string;

  constructor(
    @InjectRepository(Video) private readonly videos: Repository<Video>,
    config: ConfigService<AppConfig, true>,
  ) {
    this.uploadDir = config.get('UPLOAD_DIR', { infer: true });
    this.tempDir = config.get('TEMP_UPLOAD_DIR', { infer: true });
  }

  // videoId da duoc UploadController sinh TRUOC khi ghi file (de dat ten file
  // theo id) — luu voi id da co san thay vi de TypeORM tu sinh.
  async registerUpload(
    videoId: string,
    userId: string,
    path: string,
    originalName: string | null,
  ): Promise<Video> {
    return this.videos.save(
      this.videos.create({ id: videoId, userId, originalKey: path, originalName }),
    );
  }

  // Dung boi stream.controller.ts o muc 7. Kiem userId ngay tai day: video
  // khong thuoc ve nguoi goi thi coi nhu khong ton tai, khong tiet lo no co
  // ton tai o dau khac hay khong.
  async findPlayable(id: string, userId: string): Promise<PlayableAsset> {
    const video = await this.videos.findOne({ where: { id, userId } });
    if (video === null) {
      throw new NotFoundException('Khong tim thay video');
    }
    return {
      path: video.originalKey,
      sizeBytes: Number(video.size ?? 0),
      // storageKey la duong dan TUONG DOI ma nginx alias /var/media/ ghep
      // vao — dung khi uploadDir chinh la /var/media (xem docker-compose Part 3).
      storageKey: basename(video.originalKey),
    };
  }
}

UPLOAD_DIR: z.string().default('./uploads'),
TEMP_UPLOAD_DIR: z.string().default('./uploads/tmp'),

// TU LAM — bo qua rat nhieu truong hop
request.pipe(createWriteStream(target)); // client ngat giua chung?
                                         // dia day? -> file rac nam lai,
                                         // handle khong dong

// PIPELINE — mot dau hong thi huy ca chuoi, dong sach
await pipeline(request, createWriteStream(target));

import { mkdir, readdir } from 'node:fs/promises';

// Client chia file thanh cac manh 5MB va gui lan luot.
@Post('upload/:uploadId/chunk/:index')
async uploadChunk(
  @Param('uploadId') uploadId: string,
  @Param('index') index: string,
  @Req() request: AuthedRequest,
) {
  const target = join(this.media.tempDir, uploadId, `${index}.part`);
  // Thu muc con theo tung uploadId chua tung duoc tao truoc do.
  await mkdir(join(this.media.tempDir, uploadId), { recursive: true });
  await pipeline(request, createWriteStream(target));
  return { received: Number(index) };
}

// Truoc khi gui tiep, client hoi: toi da gui toi dau roi?
@Get('upload/:uploadId/status')
async status(@Param('uploadId') uploadId: string) {
  const parts = await readdir(join(this.media.tempDir, uploadId));
  return { received: parts.map((p) => Number(p.replace('.part', ''))).sort((a, b) => a - b) };
}

import { createReadStream } from 'node:fs';
import { rm } from 'node:fs/promises';

// Client goi endpoint nay khi da gui xong tat ca cac manh.
@Post('upload/:uploadId/complete')
async completeUpload(
  @Param('uploadId') uploadId: string,
  @CurrentUser() user: JwtPayload,
): Promise<{ videoId: string }> {
  const tempPath = join(this.media.tempDir, uploadId);
  const parts = await readdir(tempPath);
  const ordered = parts.map((p) => Number(p.replace('.part', ''))).sort((a, b) => a - b);

  const videoId = randomUUID();
  const target = join(this.media.uploadDir, `${videoId}.bin`);
  const out = createWriteStream(target);

  // MOT writeStream duy nhat cho ca file dich. { end: false } de pipeline
  // khong tu dong voi moi manh, chi dong that su o cuoi vong lap.
  for (const index of ordered) {
    await pipeline(createReadStream(join(tempPath, `${index}.part`)), out, { end: false });
  }
  out.end();

  // Da ghep xong, thu muc chua tung manh khong con can nua.
  await rm(tempPath, { recursive: true, force: true });

  const video = await this.media.registerUpload(videoId, user.sub, target, null);
  return { videoId: video.id };
}

GET /media/abc123/play HTTP/1.1
Range: bytes=52428800-

HTTP/1.1 206 Partial Content
Content-Range: bytes 52428800-104857599/104857600
Content-Length: 52428800
Accept-Ranges: bytes
Content-Type: video/mp4

@Get(':id/play')
@UseGuards(JwtAuthGuard)
async play(
  @Param('id') id: string,
  @CurrentUser() user: JwtPayload,
  @Req() request: Request,
  @Res() response: Response,
): Promise<void> {
  const asset = await this.media.findPlayable(id, user.sub);
  const size = asset.sizeBytes;
  const range = request.headers.range;

  if (range === undefined) {
    response.writeHead(200, { 'Content-Length': size, 'Accept-Ranges': 'bytes' });
    await pipeline(createReadStream(asset.path), response);
    return;
  }

  // "bytes=52428800-" hoac "bytes=0-1023"
  const [rawStart, rawEnd] = range.replace('bytes=', '').split('-');
  const start = Number(rawStart);
  const end = rawEnd === undefined || rawEnd === '' ? size - 1 : Number(rawEnd);

  if (Number.isNaN(start) || start >= size || end >= size) {
    response.writeHead(416, { 'Content-Range': `bytes */${size}` });
    response.end();
    return;
  }

  response.writeHead(206, {
    'Content-Range': `bytes ${start}-${end}/${size}`,
    'Content-Length': end - start + 1,
    'Accept-Ranges': 'bytes',
    'Content-Type': 'video/mp4',
  });

  await pipeline(createReadStream(asset.path, { start, end }), response);
}

location /protected-media/ {
    internal;                 # go thang URL nay tu ngoai vao -> 404
    alias /var/media/;
    sendfile on;
    tcp_nopush on;
}

@Get(':id/play')
@UseGuards(JwtAuthGuard)
async play(
  @Param('id') id: string,
  @CurrentUser() user: JwtPayload,
  @Res() response: Response,
): Promise<void> {
  // Nest van lam phan kho: kiem tra quyen, han muc, trang thai video.
  const asset = await this.media.findPlayable(id, user.sub);

  response.setHeader('X-Accel-Redirect', `/protected-media/${asset.storageKey}`);
  response.setHeader('Content-Type', 'video/mp4');
  response.end(); // Body rong. nginx thay header tren va tu gui file.
}

import { Injectable } from '@nestjs/common';
import { ConfigService } from '@nestjs/config';
import { createHmac, timingSafeEqual } from 'node:crypto';
import type { AppConfig } from '../config/configuration';

@Injectable()
export class SignedUrlService {
  constructor(private readonly config: ConfigService<AppConfig, true>) {}

  private get secret(): string {
    return this.config.get('SIGNED_URL_SECRET', { infer: true });
  }

  sign(assetId: string, userId: string, ttlSeconds = 300): string {
    const expires = Math.floor(Date.now() / 1000) + ttlSeconds;
    const payload = `${assetId}:${userId}:${expires}`;
    const signature = createHmac('sha256', this.secret).update(payload).digest('base64url');
    return `/media/${assetId}/play?u=${userId}&e=${expires}&s=${signature}`;
  }

  verify(assetId: string, userId: string, expires: number, signature: string): boolean {
    if (expires < Math.floor(Date.now() / 1000)) return false;

    const expected = createHmac('sha256', this.secret)
      .update(`${assetId}:${userId}:${expires}`)
      .digest('base64url');

    const a = Buffer.from(signature);
    const b = Buffer.from(expected);
    // So sanh thoi gian hang so. Dung === thi thoat som o byte dau tien khac nhau,
    // va chenh lech thoi gian do duoc de do dan tung byte cua chu ky.
    return a.length === b.length && timingSafeEqual(a, b);
  }
}

import { Controller, Get, Param, Query, Res, UnauthorizedException, UseGuards } from '@nestjs/common';
import type { Response } from 'express';
import { JwtAuthGuard } from '../auth/jwt-auth.guard';
import { CurrentUser } from '../auth/current-user.decorator';
import type { JwtPayload } from '../auth/jwt-payload';
import { MediaService } from './media.service';
import { SignedUrlService } from './signed-url.service';

@Controller('media')
export class StreamController {
  constructor(
    private readonly media: MediaService,
    private readonly signedUrl: SignedUrlService,
  ) {}

  // Doi hoi JwtAuthGuard binh thuong: lay URL nay la mot lenh goi tu chinh
  // trang SPA qua fetch/XHR, no gui duoc header Authorization.
  @Get(':id/signed-url')
  @UseGuards(JwtAuthGuard)
  async getSignedUrl(
    @Param('id') id: string,
    @CurrentUser() user: JwtPayload,
  ): Promise<{ url: string }> {
    // Kiem quyen xem NGAY tai day — phat URL cho video khong thuoc ve nguoi
    // goi thi coi nhu tim khong thay, giong het play() ben duoi.
    await this.media.findPlayable(id, user.sub);
    return { url: this.signedUrl.sign(id, user.sub) };
  }

  // KHONG dung JwtAuthGuard — day chinh la route ma URL co chu ky ton tai de
  // phuc vu, vi the <video src="..."> khong gui duoc header Authorization.
  @Get(':id/play')
  async play(
    @Param('id') id: string,
    // Khong co ValidationPipe toan cuc — @Query() khong dam bao gia tri ton
    // tai luc runtime du kieu khai bao la string. Kiem tra tay truoc khi dung.
    @Query('u') userId: string | undefined,
    @Query('e') expires: string | undefined,
    @Query('s') signature: string | undefined,
    @Res() response: Response,
  ): Promise<void> {
    if (
      userId === undefined ||
      expires === undefined ||
      signature === undefined ||
      !this.signedUrl.verify(id, userId, Number(expires), signature)
    ) {
      throw new UnauthorizedException('URL het han hoac khong hop le');
    }

    // Nest van lam phan kho: kiem tra quyen, han muc, trang thai video.
    const asset = await this.media.findPlayable(id, userId);

    response.setHeader('X-Accel-Redirect', `/protected-media/${asset.storageKey}`);
    response.setHeader('Content-Type', 'video/mp4');
    response.end(); // Body rong. nginx thay header tren va tu gui file.
  }
}

// Doc lap voi JWT_SECRET vi khac vong doi: URL nay het han sau vai phut,
// khong phai vai phut sau khi dang xuat.
SIGNED_URL_SECRET: z.string().min(32),

npm create vite@latest media-forge-web -- --template react-ts
cd media-forge-web
npm i
npm i -D tailwindcss @tailwindcss/vite

import { defineConfig } from 'vite';
import react from '@vitejs/plugin-react';
import tailwindcss from '@tailwindcss/vite';

export default defineConfig({
  plugins: [react(), tailwindcss()],
});

@import "tailwindcss";

let accessToken: string | null = null;

// Bien then chot: MOT promise refresh dung chung cho ca ung dung.
let refreshing: Promise<void> | null = null;

async function refreshOnce(): Promise<void> {
  // Da co ai dang refresh thi cho ket qua cua ho, khong goi them lan nua.
  refreshing ??= (async () => {
    const res = await fetch('/auth/refresh', { method: 'POST', credentials: 'include' });
    if (!res.ok) throw new Error('Phien dang nhap het hieu luc');
    const data = (await res.json()) as { accessToken: string };
    accessToken = data.accessToken;
  })().finally(() => {
    refreshing = null;
  });

  return refreshing;
}

export async function api(path: string, init: RequestInit = {}): Promise<Response> {
  const call = (): Promise<Response> =>
    fetch(path, {
      ...init,
      credentials: 'include',
      headers: {
        ...init.headers,
        ...(accessToken === null ? {} : { Authorization: `Bearer ${accessToken}` }),
      },
    });

  const first = await call();
  if (first.status !== 401) return first;

  await refreshOnce();
  return call(); // thu lai dung mot lan
}

export function uploadWithProgress(
  file: File,
  token: string,
  onProgress: (percent: number) => void,
): Promise<{ videoId: string }> {
  return new Promise((resolve, reject) => {
    const xhr = new XMLHttpRequest();
    xhr.open('POST', '/media/upload');
    xhr.setRequestHeader('Authorization', `Bearer ${token}`);
    xhr.setRequestHeader('Content-Type', 'application/octet-stream');
    // Ten file goc di kem qua header rieng, encode de an toan qua HTTP header
    // (xem src/media/upload.controller.ts o muc 6, noi header nay duoc doc lai).
    xhr.setRequestHeader('X-Filename', encodeURIComponent(file.name));

    // upload.onprogress — thu ma fetch khong co.
    xhr.upload.onprogress = (event) => {
      if (event.lengthComputable) {
        onProgress(Math.round((event.loaded / event.total) * 100));
      }
    };

    xhr.onload = () => {
      if (xhr.status >= 200 && xhr.status < 300) {
        resolve(JSON.parse(xhr.responseText) as { videoId: string });
      } else {
        reject(new Error(`Upload that bai: ${xhr.status}`));
      }
    };
    xhr.onerror = () => reject(new Error('Mat ket noi'));

    // Gui thang File. Trinh duyet tu doc theo stream, khong nap het vao RAM.
    xhr.send(file);
  });
}

export function VideoPlayer({ assetId }: { assetId: string }): JSX.Element {
  const [src, setSrc] = useState<string | null>(null);

  useEffect(() => {
    // The <video> khong gui duoc header Authorization, nen xin URL co chu ky.
    api(`/media/${assetId}/signed-url`)
      .then((res) => res.json() as Promise<{ url: string }>)
      .then((data) => setSrc(data.url));
  }, [assetId]);

  if (src === null) return <div className="h-64 animate-pulse rounded-lg bg-slate-200" />;

  return <video src={src} controls className="w-full rounded-lg shadow-lg" />;
}