fix sso core folder
This commit is contained in:
lendry
283
apps/sso-core/src/domain/media.service.ts
Normal file
283
apps/sso-core/src/domain/media.service.ts
Normal file
@@ -0,0 +1,283 @@
|
||||
import { BadRequestException, ForbiddenException, Injectable, NotFoundException } from '@nestjs/common';
|
||||
import { ConfigService } from '@nestjs/config';
|
||||
import { JwtService } from '@nestjs/jwt';
|
||||
import { GetObjectCommand } from '@aws-sdk/client-s3';
|
||||
import { PrismaService } from '../infra/prisma.service';
|
||||
import { AccessService } from './access.service';
|
||||
import { MinioService } from '../infra/minio.service';
|
||||
|
||||
const AVATAR_ACCESS_TTL_SECONDS = 900;
|
||||
|
||||
interface MediaStreamPayload {
|
||||
purpose: 'media-stream';
|
||||
objectKey: string;
|
||||
ownerId: string;
|
||||
roomId?: string;
|
||||
fileName?: string;
|
||||
}
|
||||
|
||||
@Injectable()
|
||||
export class MediaService {
|
||||
constructor(
|
||||
private readonly prisma: PrismaService,
|
||||
private readonly minio: MinioService,
|
||||
private readonly jwt: JwtService,
|
||||
private readonly config: ConfigService,
|
||||
private readonly access: AccessService
|
||||
) {}
|
||||
|
||||
async createAvatarUploadUrl(userId: string, contentType: string) {
|
||||
try {
|
||||
this.minio.assertImageContentType(contentType);
|
||||
} catch (error) {
|
||||
throw new BadRequestException(error instanceof Error ? error.message : 'Некорректный тип файла');
|
||||
}
|
||||
const extension = this.minio.extensionForContentType(contentType);
|
||||
const storageKey = `avatars/${userId}/${crypto.randomUUID()}.${extension}`;
|
||||
const presigned = await this.minio.createPresignedUploadUrl(storageKey, contentType);
|
||||
return { ...presigned, storageKey };
|
||||
}
|
||||
|
||||
async confirmAvatar(userId: string, storageKey: string) {
|
||||
if (!storageKey.startsWith(`avatars/${userId}/`)) {
|
||||
throw new BadRequestException('Некорректный ключ аватара');
|
||||
}
|
||||
|
||||
await this.prisma.user.update({
|
||||
where: { id: userId },
|
||||
data: {
|
||||
avatarStorageKey: storageKey,
|
||||
avatarUrl: null
|
||||
}
|
||||
});
|
||||
|
||||
return { userId, hasAvatar: true };
|
||||
}
|
||||
|
||||
async getAvatarAccessUrl(requesterId: string, targetUserId: string) {
|
||||
const user = await this.prisma.user.findUnique({ where: { id: targetUserId } });
|
||||
if (!user?.avatarStorageKey) {
|
||||
throw new NotFoundException('Аватар не найден');
|
||||
}
|
||||
|
||||
if (requesterId !== targetUserId) {
|
||||
const requester = await this.prisma.user.findUnique({ where: { id: requesterId } });
|
||||
if (!requester?.isSuperAdmin) {
|
||||
throw new ForbiddenException('Нет доступа к аватару пользователя');
|
||||
}
|
||||
}
|
||||
|
||||
const token = await this.jwt.signAsync(
|
||||
{
|
||||
purpose: 'media-stream',
|
||||
objectKey: user.avatarStorageKey,
|
||||
ownerId: targetUserId
|
||||
} satisfies MediaStreamPayload,
|
||||
{
|
||||
secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'),
|
||||
expiresIn: AVATAR_ACCESS_TTL_SECONDS,
|
||||
issuer: 'id.lendry.ru'
|
||||
}
|
||||
);
|
||||
|
||||
const publicApiUrl = this.config.get<string>('PUBLIC_API_URL', 'http://localhost:3000').replace(/\/$/, '');
|
||||
return {
|
||||
accessUrl: `${publicApiUrl}/media/stream/${token}`,
|
||||
expiresAt: new Date(Date.now() + AVATAR_ACCESS_TTL_SECONDS * 1000).toISOString()
|
||||
};
|
||||
}
|
||||
|
||||
async createDocumentPhotoUploadUrl(userId: string, documentId: string, contentType: string) {
|
||||
try {
|
||||
this.minio.assertImageContentType(contentType);
|
||||
} catch (error) {
|
||||
throw new BadRequestException(error instanceof Error ? error.message : 'Некорректный тип файла');
|
||||
}
|
||||
const document = await this.prisma.userDocument.findFirst({
|
||||
where: { id: documentId, userId }
|
||||
});
|
||||
if (!document) {
|
||||
throw new NotFoundException('Документ не найден');
|
||||
}
|
||||
|
||||
const extension = this.minio.extensionForContentType(contentType);
|
||||
const storageKey = `documents/${userId}/${documentId}/${crypto.randomUUID()}.${extension}`;
|
||||
const presigned = await this.minio.createPresignedUploadUrl(storageKey, contentType);
|
||||
return { ...presigned, storageKey };
|
||||
}
|
||||
|
||||
async resolveStreamToken(token: string, requesterId?: string) {
|
||||
let payload: MediaStreamPayload;
|
||||
try {
|
||||
payload = await this.jwt.verifyAsync<MediaStreamPayload>(token, {
|
||||
secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'),
|
||||
issuer: 'id.lendry.ru'
|
||||
});
|
||||
} catch {
|
||||
throw new ForbiddenException('Ссылка недействительна или истекла');
|
||||
}
|
||||
|
||||
if (payload.purpose !== 'media-stream' || !payload.objectKey) {
|
||||
throw new ForbiddenException('Ссылка недействительна');
|
||||
}
|
||||
|
||||
if (payload.objectKey.startsWith('chat/')) {
|
||||
if (!requesterId) {
|
||||
throw new ForbiddenException('Для доступа к файлу чата требуется авторизация');
|
||||
}
|
||||
const roomId = payload.roomId ?? this.extractChatRoomId(payload.objectKey);
|
||||
if (!roomId) {
|
||||
throw new ForbiddenException('Некорректный ключ файла чата');
|
||||
}
|
||||
await this.assertChatMember(roomId, requesterId);
|
||||
}
|
||||
|
||||
const contentType = this.minio.contentTypeForKey(payload.objectKey);
|
||||
|
||||
return {
|
||||
storageKey: payload.objectKey,
|
||||
contentType,
|
||||
fileName: payload.fileName
|
||||
};
|
||||
}
|
||||
|
||||
async getObjectStream(storageKey: string) {
|
||||
return this.minio.getClient().send(
|
||||
new GetObjectCommand({
|
||||
Bucket: this.minio.getBucket(),
|
||||
Key: storageKey
|
||||
})
|
||||
);
|
||||
}
|
||||
|
||||
async getDocumentPhotoAccessUrl(requesterId: string, targetUserId: string, storageKey: string) {
|
||||
await this.access.assertCanViewUserDocuments(requesterId, targetUserId);
|
||||
|
||||
if (!storageKey.startsWith(`documents/${targetUserId}/`)) {
|
||||
throw new BadRequestException('Некорректный ключ фото документа');
|
||||
}
|
||||
|
||||
const token = await this.jwt.signAsync(
|
||||
{
|
||||
purpose: 'media-stream',
|
||||
objectKey: storageKey,
|
||||
ownerId: targetUserId
|
||||
} satisfies MediaStreamPayload,
|
||||
{
|
||||
secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'),
|
||||
expiresIn: AVATAR_ACCESS_TTL_SECONDS,
|
||||
issuer: 'id.lendry.ru'
|
||||
}
|
||||
);
|
||||
|
||||
const publicApiUrl = this.config.get<string>('PUBLIC_API_URL', 'http://localhost:3000').replace(/\/$/, '');
|
||||
return {
|
||||
accessUrl: `${publicApiUrl}/media/stream/${token}`,
|
||||
expiresAt: new Date(Date.now() + AVATAR_ACCESS_TTL_SECONDS * 1000).toISOString()
|
||||
};
|
||||
}
|
||||
|
||||
async createFamilyAvatarUploadUrl(requesterId: string, groupId: string, contentType: string) {
|
||||
await this.assertFamilyMember(groupId, requesterId);
|
||||
try {
|
||||
this.minio.assertImageContentType(contentType);
|
||||
} catch (error) {
|
||||
throw new BadRequestException(error instanceof Error ? error.message : 'Некорректный тип файла');
|
||||
}
|
||||
const extension = this.minio.extensionForContentType(contentType);
|
||||
const storageKey = `families/${groupId}/${crypto.randomUUID()}.${extension}`;
|
||||
const presigned = await this.minio.createPresignedUploadUrl(storageKey, contentType);
|
||||
return { ...presigned, storageKey };
|
||||
}
|
||||
|
||||
async confirmFamilyAvatar(requesterId: string, groupId: string, storageKey: string) {
|
||||
await this.assertFamilyMember(groupId, requesterId);
|
||||
if (!storageKey.startsWith(`families/${groupId}/`)) {
|
||||
throw new BadRequestException('Некорректный ключ аватара семьи');
|
||||
}
|
||||
await this.prisma.familyGroup.update({
|
||||
where: { id: groupId },
|
||||
data: { avatarStorageKey: storageKey, hasAvatar: true }
|
||||
});
|
||||
return { groupId, hasAvatar: true };
|
||||
}
|
||||
|
||||
async getFamilyAvatarAccessUrl(requesterId: string, groupId: string) {
|
||||
await this.assertFamilyMember(groupId, requesterId);
|
||||
const group = await this.prisma.familyGroup.findUnique({ where: { id: groupId } });
|
||||
if (!group?.avatarStorageKey) {
|
||||
throw new NotFoundException('Аватар семьи не найден');
|
||||
}
|
||||
return this.createStreamAccessUrl(group.avatarStorageKey, groupId);
|
||||
}
|
||||
|
||||
async createChatMediaUploadUrl(requesterId: string, roomId: string, contentType: string, fileName?: string) {
|
||||
await this.assertChatMember(roomId, requesterId);
|
||||
let normalized: string;
|
||||
try {
|
||||
normalized = this.minio.assertChatMediaContentType(contentType, fileName);
|
||||
} catch (error) {
|
||||
throw new BadRequestException(error instanceof Error ? error.message : 'Некорректный тип файла');
|
||||
}
|
||||
const extension = this.minio.extensionForChatMedia(normalized, fileName);
|
||||
const storageKey = `chat/${roomId}/${crypto.randomUUID()}.${extension}`;
|
||||
const presigned = await this.minio.createPresignedUploadUrl(storageKey, normalized);
|
||||
return { ...presigned, storageKey };
|
||||
}
|
||||
|
||||
async getChatMediaAccessUrl(requesterId: string, roomId: string, storageKey: string, fileName?: string) {
|
||||
await this.assertChatMember(roomId, requesterId);
|
||||
if (!storageKey.startsWith(`chat/${roomId}/`)) {
|
||||
throw new BadRequestException('Некорректный ключ медиафайла');
|
||||
}
|
||||
return this.createStreamAccessUrl(storageKey, requesterId, { roomId, fileName });
|
||||
}
|
||||
|
||||
private extractChatRoomId(storageKey: string) {
|
||||
const [prefix, roomId] = storageKey.split('/');
|
||||
if (prefix !== 'chat' || !roomId) {
|
||||
return null;
|
||||
}
|
||||
return roomId;
|
||||
}
|
||||
|
||||
private async createStreamAccessUrl(
|
||||
storageKey: string,
|
||||
ownerId: string,
|
||||
options?: { roomId?: string; fileName?: string }
|
||||
) {
|
||||
const token = await this.jwt.signAsync(
|
||||
{
|
||||
purpose: 'media-stream',
|
||||
objectKey: storageKey,
|
||||
ownerId,
|
||||
roomId: options?.roomId,
|
||||
fileName: options?.fileName
|
||||
} satisfies MediaStreamPayload,
|
||||
{
|
||||
secret: this.config.getOrThrow<string>('JWT_ACCESS_SECRET'),
|
||||
expiresIn: AVATAR_ACCESS_TTL_SECONDS,
|
||||
issuer: 'id.lendry.ru'
|
||||
}
|
||||
);
|
||||
const publicApiUrl = this.config.get<string>('PUBLIC_API_URL', 'http://localhost:3000').replace(/\/$/, '');
|
||||
return {
|
||||
accessUrl: `${publicApiUrl}/media/stream/${token}`,
|
||||
expiresAt: new Date(Date.now() + AVATAR_ACCESS_TTL_SECONDS * 1000).toISOString()
|
||||
};
|
||||
}
|
||||
|
||||
private async assertFamilyMember(groupId: string, userId: string) {
|
||||
const member = await this.prisma.familyMember.findFirst({ where: { groupId, userId } });
|
||||
if (!member) {
|
||||
throw new ForbiddenException('Нет доступа к семье');
|
||||
}
|
||||
}
|
||||
|
||||
private async assertChatMember(roomId: string, userId: string) {
|
||||
const member = await this.prisma.chatRoomMember.findFirst({ where: { roomId, userId } });
|
||||
if (!member) {
|
||||
throw new ForbiddenException('Нет доступа к чату');
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user