nestjs accessKey, RAM, username/password

1
2
3
4
5
6
7
8
9
10
// app.module.ts
import { ConfigModule } from '@nestjs/config'

@Module({
  imports: [
    ConfigModule.forRoot({ isGlobal: true }),
    OssModule,
  ],
})
export class AppModule {}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
// oss.service.ts
import { Injectable } from '@nestjs/common'
import { ConfigService } from '@nestjs/config'
import OSS from 'ali-oss'

@Injectable()
export class OssService {
  private client: OSS

  constructor(private readonly config: ConfigService) {
    this.client = new OSS({
      accessKeyId: config.getOrThrow('ALIYUN_ACCESS_KEY_ID'),
      accessKeySecret: config.getOrThrow('ALIYUN_ACCESS_KEY_SECRET'),
      bucket: config.getOrThrow('ALIYUN_OSS_BUCKET'),
      region: config.getOrThrow('ALIYUN_OSS_REGION'),
    })
  }

  async put(key: string, buffer: Buffer) {
    return this.client.put(key, buffer)
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
import * as Sts from '@alicloud/sts20150401'

@Injectable()
export class StsService {
  constructor(private readonly config: ConfigService) {}

  async assumeRole(userId: string) {
    const client = new Sts.default({
      accessKeyId: this.config.getOrThrow('ALIYUN_ACCESS_KEY_ID'),
      accessKeySecret: this.config.getOrThrow('ALIYUN_ACCESS_KEY_SECRET'),
      endpoint: 'sts.aliyuncs.com',
    })
    const res = await client.assumeRole({
      roleArn: 'acs:ram::123456:role/oss-uploader',
      roleSessionName: `user-${userId}`,
      durationSeconds: 3600, // 1 小时后失效
      policy: JSON.stringify({
        Version: '1',
        Statement: [
          {
            Effect: 'Allow',
            Action: ['oss:PutObject'],
            Resource: [`acs:oss:*:*:my-bucket/uploads/${userId}/*`],
          },
        ],
      }),
    })
    return res.body?.credentials // { AccessKeyId, AccessKeySecret, SecurityToken, Expiration }
  }
}

1
2
3
4
5
6
7
8
9
10
11
// access-key.entity.ts
@Entity()
export class AccessKey {
  @PrimaryGeneratedColumn('uuid') id: string
  @Column({ unique: true })       accessKeyId: string  // 公开，可上日志
  @Column()                       secretHash: string   // ✅ 只存 hash
  @Column()                       userId: string
  @Column({ default: 'active' })  status: 'active' | 'disabled'
  @Column({ nullable: true })     lastUsedAt: Date
  @CreateDateColumn()             createdAt: Date
}

1
2
3
4
5
6
7
8
import { randomBytes, createHash } from 'node:crypto'

generateAccessKey() {
  const accessKeyId = 'AK' + randomBytes(16).toString('hex')   // 32 字符
  const secret      = randomBytes(32).toString('base64url')    // 43 字符
  const secretHash  = createHash('sha256').update(secret).digest('hex')
  return { accessKeyId, secret, secretHash }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
import { CanActivate, ExecutionContext, Injectable, UnauthorizedException } from '@nestjs/common'
import { createHmac, timingSafeEqual } from 'node:crypto'

@Injectable()
export class AkSignatureGuard implements CanActivate {
  constructor(private readonly repo: AccessKeyRepository) {}

  async canActivate(ctx: ExecutionContext) {
    const req = ctx.switchToHttp().getRequest()
    const ak  = req.header('X-Ak-Id')
    const ts  = req.header('X-Ak-Timestamp')
    const sig = req.header('X-Ak-Signature')

    if (!ak || !ts || !sig) throw new UnauthorizedException('missing signature')
    if (Math.abs(Date.now() - Number(ts)) > 5 * 60_000) {
      throw new UnauthorizedException('timestamp expired') // 防重放
    }

    const key = await this.repo.findActive(ak)
    if (!key) throw new UnauthorizedException()

    // 注意：你需要把 secret 明文存 KMS / Vault；这里用 hash 演示思路
    const stringToSign = `${req.method}\n${req.path}\n${ts}`
    const expect = createHmac('sha256', key.secretPlaintext).update(stringToSign).digest('hex')

    const a = Buffer.from(expect)
    const b = Buffer.from(sig)
    if (a.length !== b.length || !timingSafeEqual(a, b)) {
      throw new UnauthorizedException()
    }
    req.user = { id: key.userId }
    return true
  }
}

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
// auth.service.ts
@Injectable()
export class AuthService {
  constructor(
    private readonly users: UserService,
    private readonly jwt: JwtService,
  ) {}

  async login(username: string, password: string) {
    const user = await this.users.findByUsername(username)
    if (!user || !(await bcrypt.compare(password, user.passwordHash))) {
      throw new UnauthorizedException()
    }
    return { token: this.jwt.sign({ sub: user.id, name: user.username }) }
  }
}