Merge pull request #31 from velog-io/fix/auth-token

fix/auth-token

Author: winverse

packages/velog-server/package.json

@@ -60,7 +60,7 @@
     "graphql-scalars": "^1.22.2",
     "inquirer": "^9.2.12",
     "ioredis": "^5.3.2",
-    "jsonwebtoken": "^9.0.0",
+    "jsonwebtoken": "^9.0.2",
     "lru-cache": "^10.0.0",
     "marked": "^8.0.0",
     "mercurius": "^13.0.0",

packages/velog-server/src/common/plugins/global/authPlugin.ts

@@ -10,27 +10,39 @@ const authPlugin: FastifyPluginAsync = async (fastify) => {
   fastify.decorateRequest('user', null)
   fastify.addHook('preHandler', async (request, reply) => {
     if (request.url.includes('/auth/logout')) return
+
+    const userService = container.resolve(UserService)
     let accessToken: string | undefined = request.cookies['access_token']
     const refreshToken: string | undefined = request.cookies['refresh_token']
     const authorization = request.headers['authorization']
+
     try {
       if (!accessToken && authorization) {
         accessToken = authorization.split('Bearer ')[1]
       }
 
       const jwt = container.resolve(JwtService)
 
-      if (!accessToken) return
-      const accessTokenData = await jwt.decodeToken<AccessTokenData>(accessToken)
+      if (!accessToken && !refreshToken) return
 
-      request.user = { id: accessTokenData.user_id }
+      if (accessToken && refreshToken) {
+        const accessTokenData = await jwt.decodeToken<AccessTokenData>(accessToken)
+        const diff = accessTokenData.exp * 1000 - new Date().getTime()
+        // refresh token when life < 30mins
+        if (diff < Time.ONE_MINUTE_IN_MS * 30 && refreshToken) {
+          await userService.restoreToken({ request, reply })
+        }
+      }
 
-      const diff = accessTokenData.exp * 1000 - new Date().getTime()
-      // refresh token when life < 30mins
-      if (diff < Time.ONE_MINUTE_IN_MS * 30 && refreshToken) {
-        const userService = container.resolve(UserService)
-        await userService.restoreToken({ request, reply })
+      if (!accessToken && refreshToken) {
+        const tokens = await userService.restoreToken({ request, reply })
+        accessToken = tokens.accessToken
       }
+
+      if (!accessToken) return
+
+      const accessTokenData = await jwt.decodeToken<AccessTokenData>(accessToken)
+      request.user = { id: accessTokenData.user_id }
     } catch (e) {
       console.log('accessToken', accessToken)
       console.log('authPlugin error', e)

packages/velog-server/src/lib/jwt/JwtService.ts

@@ -63,7 +63,7 @@ export class JwtService {
       },
       {
         subject: 'access_token',
-        expiresIn: '1h',
+        expiresIn: '24h',
       },
     )
 
@@ -100,7 +100,7 @@ export class JwtService {
       },
       {
         subject: 'access_token',
-        expiresIn: '1h',
+        expiresIn: '24h',
       },
     )
 

packages/velog-server/src/routes/auth/v3/social/SocialController.ts

@@ -131,7 +131,7 @@ export class SocialController implements Controller {
       if (user) {
         const tokens = await this.jwt.generateUserToken(user.id)
         this.cookie.setCookie(reply, 'access_token', tokens.accessToken, {
-          maxAge: Time.ONE_HOUR_IN_MS,
+          maxAge: Time.ONE_HOUR_IN_MS * 24,
         })
         this.cookie.setCookie(reply, 'refresh_token', tokens.refreshToken, {
           maxAge: Time.ONE_DAY_IN_MS * 30,
@@ -255,7 +255,7 @@ export class SocialController implements Controller {
 
     const tokens = await this.jwt.generateUserToken(user.id)
     this.cookie.setCookie(reply, 'access_token', tokens.accessToken, {
-      maxAge: Time.ONE_HOUR_IN_MS,
+      maxAge: Time.ONE_HOUR_IN_MS * 24,
     })
     this.cookie.setCookie(reply, 'refresh_token', tokens.refreshToken, {
       maxAge: Time.ONE_DAY_IN_MS * 30,

packages/velog-server/src/services/UserService/index.ts

@@ -144,7 +144,7 @@ export class UserService implements Service {
     )
 
     this.cookie.setCookie(ctx.reply, 'access_token', tokens.accessToken, {
-      maxAge: Time.ONE_HOUR_IN_MS,
+      maxAge: Time.ONE_HOUR_IN_MS * 24,
     })
     this.cookie.setCookie(ctx.reply, 'refresh_token', tokens.refreshToken, {
       maxAge: Time.ONE_DAY_IN_MS * 30,