AWS Cognito – Authentication as a Service cho NodeJS

// src/auth/cognito.service.ts
import {
  CognitoIdentityProviderClient,
  InitiateAuthCommand,
  SignUpCommand,
  ConfirmSignUpCommand,
  GetUserCommand,
  GlobalSignOutCommand,
  ForgotPasswordCommand,
  ConfirmForgotPasswordCommand,
  ChangePasswordCommand,
  AdminCreateUserCommand,
  AdminSetUserPasswordCommand,
  AdminGetUserCommand,
  AdminDeleteUserCommand,
} from '@aws-sdk/client-cognito-identity-provider';
import * as crypto from 'crypto';

@Injectable()
export class CognitoService {
  private client: CognitoIdentityProviderClient;
  private readonly userPoolId: string;
  private readonly clientId: string;
  private readonly clientSecret: string;

  constructor() {
    this.client = new CognitoIdentityProviderClient({
      region: process.env.AWS_REGION ?? 'ap-southeast-1',
    });
    this.userPoolId = process.env.COGNITO_USER_POOL_ID!;
    this.clientId = process.env.COGNITO_CLIENT_ID!;
    this.clientSecret = process.env.COGNITO_CLIENT_SECRET ?? '';
  }

  // Tính SECRET_HASH khi App Client có secret
  private getSecretHash(username: string): string {
    if (!this.clientSecret) return '';
    const hmac = crypto.createHmac('sha256', this.clientSecret);
    hmac.update(username + this.clientId);
    return hmac.digest('base64');
  }

  // Đăng ký
  async signUp(email: string, password: string, name: string) {
    const command = new SignUpCommand({
      ClientId: this.clientId,
      Username: email,
      Password: password,
      SecretHash: this.getSecretHash(email),
      UserAttributes: [
        { Name: 'email', Value: email },
        { Name: 'name', Value: name },
      ],
    });

    return this.client.send(command);
  }

  // Xác nhận email (OTP từ Cognito gửi)
  async confirmSignUp(email: string, code: string) {
    const command = new ConfirmSignUpCommand({
      ClientId: this.clientId,
      Username: email,
      ConfirmationCode: code,
      SecretHash: this.getSecretHash(email),
    });

    return this.client.send(command);
  }

  // Đăng nhập → trả về JWT tokens
  async signIn(email: string, password: string): Promise<{
    accessToken: string;
    idToken: string;
    refreshToken: string;
    expiresIn: number;
  }> {
    const command = new InitiateAuthCommand({
      AuthFlow: 'USER_PASSWORD_AUTH',
      ClientId: this.clientId,
      AuthParameters: {
        USERNAME: email,
        PASSWORD: password,
        SECRET_HASH: this.getSecretHash(email),
      },
    });

    const result = await this.client.send(command);
    const auth = result.AuthenticationResult!;

    return {
      accessToken: auth.AccessToken!,
      idToken: auth.IdToken!,
      refreshToken: auth.RefreshToken!,
      expiresIn: auth.ExpiresIn!,
    };
  }

  // Refresh token
  async refreshTokens(refreshToken: string, email: string) {
    const command = new InitiateAuthCommand({
      AuthFlow: 'REFRESH_TOKEN_AUTH',
      ClientId: this.clientId,
      AuthParameters: {
        REFRESH_TOKEN: refreshToken,
        SECRET_HASH: this.getSecretHash(email),
      },
    });

    const result = await this.client.send(command);
    return result.AuthenticationResult;
  }

  // Quên mật khẩu
  async forgotPassword(email: string) {
    const command = new ForgotPasswordCommand({
      ClientId: this.clientId,
      Username: email,
      SecretHash: this.getSecretHash(email),
    });
    return this.client.send(command);
  }

  // Đặt lại mật khẩu
  async confirmForgotPassword(email: string, code: string, newPassword: string) {
    const command = new ConfirmForgotPasswordCommand({
      ClientId: this.clientId,
      Username: email,
      ConfirmationCode: code,
      Password: newPassword,
      SecretHash: this.getSecretHash(email),
    });
    return this.client.send(command);
  }

  // Đăng xuất tất cả thiết bị
  async signOut(accessToken: string) {
    const command = new GlobalSignOutCommand({ AccessToken: accessToken });
    return this.client.send(command);
  }
}

// src/auth/cognito-jwt.strategy.ts
import { Injectable } from '@nestjs/common';
import { PassportStrategy } from '@nestjs/passport';
import { ExtractJwt, Strategy } from 'passport-jwt';
import * as jwksClient from 'jwks-rsa';

@Injectable()
export class CognitoJwtStrategy extends PassportStrategy(Strategy, 'cognito-jwt') {
  constructor() {
    super({
      jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
      // Cognito tự quản lý public keys — lấy từ JWKS endpoint
      secretOrKeyProvider: jwksClient.passportJwtSecret({
        cache: true,
        rateLimit: true,
        jwksRequestsPerMinute: 5,
        jwksUri: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}/.well-known/jwks.json`,
      }),
      audience: process.env.COGNITO_CLIENT_ID,
      issuer: `https://cognito-idp.${process.env.AWS_REGION}.amazonaws.com/${process.env.COGNITO_USER_POOL_ID}`,
      algorithms: ['RS256'],
    });
  }

  async validate(payload: any) {
    // payload chứa: sub, email, cognito:username, token_use
    return {
      userId: payload.sub,
      email: payload.email,
      name: payload.name,
      groups: payload['cognito:groups'] ?? [],
    };
  }
}

// src/auth/auth.controller.ts
@Controller('auth')
export class AuthController {
  constructor(private cognitoService: CognitoService) {}

  @Post('register')
  async register(@Body() dto: { email: string; password: string; name: string }) {
    await this.cognitoService.signUp(dto.email, dto.password, dto.name);
    return { message: 'Đã gửi email xác nhận. Vui lòng kiểm tra hộp thư.' };
  }

  @Post('confirm')
  async confirmEmail(@Body() dto: { email: string; code: string }) {
    await this.cognitoService.confirmSignUp(dto.email, dto.code);
    return { message: 'Xác nhận email thành công!' };
  }

  @Post('login')
  async login(@Body() dto: { email: string; password: string }) {
    return this.cognitoService.signIn(dto.email, dto.password);
  }

  @Post('refresh')
  async refresh(@Body() dto: { refreshToken: string; email: string }) {
    return this.cognitoService.refreshTokens(dto.refreshToken, dto.email);
  }

  @Post('logout')
  @UseGuards(CognitoJwtAuthGuard)
  async logout(@Headers('authorization') auth: string) {
    const token = auth.replace('Bearer ', '');
    await this.cognitoService.signOut(token);
    return { message: 'Đã đăng xuất' };
  }

  @Get('me')
  @UseGuards(CognitoJwtAuthGuard)
  getProfile(@CurrentUser() user: any) {
    return user;
  }
}

// Redirect đến Cognito Hosted UI (có sẵn UI login/register)
const loginUrl = `https://shopxyz.auth.ap-southeast-1.amazoncognito.com/login?` +
  `client_id=${clientId}` +
  `&response_type=code` +
  `&scope=openid+email+profile` +
  `&redirect_uri=${encodeURIComponent('https://shopxyz.com/auth/callback')}`;

// Callback — đổi code lấy tokens
@Get('callback')
async callback(@Query('code') code: string) {
  const tokens = await this.cognitoService.exchangeCodeForTokens(code);
  // Lưu tokens, redirect về app
}