feat(auth): implement Secure Remote Password (SRP) authentication

.github/workflows/test-coverage.yml

@@ -15,7 +15,6 @@ jobs:
         postgresql-version: [latest]
         elasticsearch-version: [8.12.2]
         node-version: [18.x]
-        pnpm-version: [8]
 
     env:
       TEST_REPEAT: 1 # Tests will be repeated
@@ -101,7 +100,6 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: ${{ matrix.pnpm-version }}
           run_install: false
 
       - name: Install Dependencies

.github/workflows/test.yml

@@ -15,7 +15,6 @@ jobs:
         postgresql-version: [latest, 12]
         elasticsearch-version: [8.12.2, 8.0.0]
         node-version: [18.x, 20.x]
-        pnpm-version: [8]
         repeat: [1, 2]
 
     env:
@@ -102,7 +101,6 @@ jobs:
       - name: Install pnpm
         uses: pnpm/action-setup@v4
         with:
-          version: ${{ matrix.pnpm-version }}
           run_install: false
 
       - name: Install Dependencies

package.json

@@ -63,6 +63,7 @@
     "qrcode": "^1.5.4",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.1",
+    "secure-remote-password": "^0.3.1",
     "uuid": "^10.0.0"
   },
   "devDependencies": {
@@ -102,5 +103,15 @@
     "ts-node": "^10.9.2",
     "tsconfig-paths": "^4.2.0",
     "typescript": "^5.7.2"
-  }
+  },
+  "pnpm": {
+    "onlyBuiltDependencies": [
+      "@nestjs/core",
+      "@prisma/client",
+      "@prisma/engines",
+      "bignum",
+      "prisma"
+    ]
+  },
+  "packageManager": "pnpm@10.4.1+sha512.c753b6c3ad7afa13af388fa6d808035a008e30ea9993f58c6663e2bc5ff21679aa834db094987129aa4d488b86df57f7b634981b2f827cdcacc698cc0cfb88af"
 }

prisma/migrations/20250219084632_add_srp_fields/migration.sql

@@ -0,0 +1,4 @@
+-- AlterTable
+ALTER TABLE "user" ADD COLUMN     "srp_salt" VARCHAR(500),
+ADD COLUMN     "srp_upgraded" BOOLEAN NOT NULL DEFAULT false,
+ADD COLUMN     "srp_verifier" VARCHAR(1000);

prisma/migrations/20250219101440_make_hashed_password_optional/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "user" ALTER COLUMN "hashed_password" DROP NOT NULL;

prisma/migrations/20250219164036_add_last_password_changed_at/migration.sql

@@ -0,0 +1,2 @@
+-- AlterTable
+ALTER TABLE "user" ADD COLUMN     "last_password_changed_at" TIMESTAMPTZ(6) NOT NULL DEFAULT CURRENT_TIMESTAMP;

prisma/schema.prisma

@@ -611,11 +611,15 @@ model TopicSearchLog {
 model User {
   id                                                                 Int                          @id(map: "PK_cace4a159ff9f2512dd42373760") @default(autoincrement())
   username                                                           String                       @unique(map: "IDX_78a916df40e02a9deb1c4b75ed") @db.VarChar
-  hashedPassword                                                     String                       @map("hashed_password") @db.VarChar
+  hashedPassword                                                     String?                      @map("hashed_password") @db.VarChar
+  srpSalt                                                            String?                      @map("srp_salt") @db.VarChar(500)
+  srpVerifier                                                        String?                      @map("srp_verifier") @db.VarChar(1000)
+  srpUpgraded                                                        Boolean                      @default(false) @map("srp_upgraded")
   email                                                              String                       @unique(map: "IDX_e12875dfb3b1d92d7d7c5377e2") @db.VarChar
   createdAt                                                          DateTime                     @default(now()) @map("created_at") @db.Timestamptz(6)
   updatedAt                                                          DateTime                     @default(now()) @updatedAt @map("updated_at") @db.Timestamptz(6)
   deletedAt                                                          DateTime?                    @map("deleted_at") @db.Timestamptz(6)
+  lastPasswordChangedAt                                              DateTime                     @default(now()) @map("last_password_changed_at") @db.Timestamptz(6)
   answer                                                             Answer[]
   answerDeleteLog                                                    AnswerDeleteLog[]
   answerFavoritedByUser                                              AnswerFavoritedByUser[]

sample.env

@@ -1,3 +1,5 @@
+APP_NAME=Cheese
+
 # The port that the app will listen to
 PORT=3000
 
@@ -70,3 +72,13 @@ EMAILTEST_RECEIVER=developer@example.com
 
 # Use real ip or X-Forwarded-For header
 TRUST_X_FORWARDED_FOR=false
+
+REDIS_HOST=valkey
+REDIS_PORT=6379
+# REDIS_USERNAME=
+# REDIS_PASSWORD=
+
+WEB_AUTHN_RP_NAME=Cheese Community
+WEB_AUTHN_RP_ID=localhost
+WEB_AUTHN_ORIGIN=http://localhost:3000
+TOTP_ENCRYPTION_KEY=sm2vSXU3SudEuBd2r6ewGiap1LbqGbjf

src/auth/definitions.ts

@@ -73,6 +73,7 @@ export interface Authorization {
   userId: number;
   permissions: Permission[];
   sudoUntil?: number; // sudo 模式过期时间戳
+  username?: string; // 用户名，用于密码重置等场景
 }
 
 export class TokenPayload {

src/auth/token-payload.schema.json

@@ -11,11 +11,14 @@
           },
           "type": "array"
         },
-        "userId": {
+        "sudoUntil": {
           "type": "number"
         },
-        "sudoUntil": {
+        "userId": {
           "type": "number"
+        },
+        "username": {
+          "type": "string"
         }
       },
       "required": [

src/users/DTO/change-password.dto.ts

@@ -0,0 +1,12 @@
+import { IsString } from 'class-validator';
+import { BaseResponseDto } from '../../common/DTO/base-response.dto';
+
+export class ChangePasswordRequestDto {
+  @IsString()
+  srpSalt: string; // 新密码的 SRP 凭证
+
+  @IsString()
+  srpVerifier: string; // 新密码的 SRP 凭证
+}
+
+export class ChangePasswordResponseDto extends BaseResponseDto {}

src/users/DTO/passkey.dto.ts

@@ -21,6 +21,10 @@ export class PasskeyRegistrationVerifyRequestDto {
 export class PasskeyRegistrationVerifyResponseDto extends BaseResponseDto {}
 
 // Authentication DTOs
+export class PasskeyAuthenticationOptionsRequestDto {
+  userId?: number;
+}
+
 export class PasskeyAuthenticationOptionsResponseDto extends BaseResponseDto {
   data: {
     options: PublicKeyCredentialRequestOptionsJSON;

src/users/DTO/register.dto.ts

@@ -1,4 +1,4 @@
-import { IsString } from 'class-validator';
+import { IsBoolean, IsOptional, IsString } from 'class-validator';
 import { LoginResponseDto } from './login.dto';
 
 export class RegisterRequestDto {
@@ -9,13 +9,28 @@ export class RegisterRequestDto {
   nickname: string;
 
   @IsString()
-  password: string;
+  @IsOptional()
+  srpSalt?: string;
+
+  @IsString()
+  @IsOptional()
+  srpVerifier?: string;
 
   @IsString()
   email: string;
 
   @IsString()
   emailCode: string;
+
+  // 可选的传统密码字段，仅用于测试
+  @IsString()
+  @IsOptional()
+  password?: string;
+
+  // 是否使用传统认证方式，仅用于测试
+  @IsBoolean()
+  @IsOptional()
+  isLegacyAuth?: boolean;
 }
 
 export class RegisterResponseDto extends LoginResponseDto {}

src/users/DTO/reset-password.dto.ts

@@ -13,7 +13,10 @@ export class ResetPasswordVerifyRequestDto {
   token: string;
 
   @IsString()
-  new_password: string;
+  srpSalt: string;
+
+  @IsString()
+  srpVerifier: string;
 }
 
 export class ResetPasswordVerifyResponseDto extends BaseResponseDto {}

src/users/DTO/srp.dto.ts

@@ -0,0 +1,33 @@
+/*
+ *  Description: This file defines the DTOs for SRP authentication.
+ */
+
+import { BaseResponseDto } from '../../common/DTO/base-response.dto';
+import { UserDto } from '../../users/DTO/user.dto';
+
+export class SrpInitRequestDto {
+  username: string;
+  clientPublicEphemeral: string;
+}
+
+export class SrpInitResponseDto extends BaseResponseDto {
+  data: {
+    salt: string;
+    serverPublicEphemeral: string;
+  };
+}
+
+export class SrpVerifyRequestDto {
+  username: string;
+  clientProof: string;
+}
+
+export class SrpVerifyResponseDto extends BaseResponseDto {
+  data: {
+    serverProof: string;
+    accessToken: string;
+    requires2FA: boolean;
+    tempToken?: string;
+    user?: UserDto;
+  };
+}