feat: add user info, collaborator and access token cache (#1859)

* feat: add user info, collaborator and access token cache

* fix: remove debug code

* chore: methods name

* fix: missing dependencies module

* fix: null value not hit cache

* fix: include Date value cache

* fix: access token service unit test

* fix: collaborator unit test

* fix: collaborator cache clear in createBaseCollaborator

* fix: cache ttl is required

* feat: delete performance cache endpoints

* test: add accessToken expired e2e

* fix: more safe typescript

Author: boris-w

apps/nestjs-backend/src/features/access-token/access-token.service.spec.ts

@@ -5,19 +5,23 @@ import { Test } from '@nestjs/testing';
 import { PrismaService } from '@teable/db-main-prisma';
 import { mockDeep, mockReset } from 'vitest-mock-extended';
 import { GlobalModule } from '../../global/global.module';
+import { AccessTokenModel } from '../model/access-token';
 import { AccessTokenModule } from './access-token.module';
 import { AccessTokenService } from './access-token.service';
 
 describe('AccessTokenService', () => {
   let accessTokenService: AccessTokenService;
   const prismaService = mockDeep<PrismaService>();
+  const accessTokenModel = mockDeep<AccessTokenModel>();
 
   beforeEach(async () => {
     const module: TestingModule = await Test.createTestingModule({
       imports: [GlobalModule, AccessTokenModule],
     })
       .overrideProvider(PrismaService)
       .useValue(prismaService)
+      .overrideProvider(AccessTokenModel)
+      .useValue(accessTokenModel)
       .compile();
 
     accessTokenService = module.get<AccessTokenService>(AccessTokenService);
@@ -47,7 +51,7 @@ describe('AccessTokenService', () => {
       const sign = 'SIGN';
       const expiredTime = new Date(Date.now() + 2000); // Expires in 2 seconds
       // Mock PrismaService response
-      prismaService.accessToken.findUniqueOrThrow.mockResolvedValue({
+      accessTokenModel.getAccessTokenRawById.mockResolvedValue({
         userId: 'user123',
         id: accessTokenId,
         sign,
@@ -74,7 +78,7 @@ describe('AccessTokenService', () => {
       const sign = 'INVALID_SIGN';
 
       // Mock PrismaService response
-      prismaService.accessToken.findUniqueOrThrow.mockResolvedValue({
+      accessTokenModel.getAccessTokenRawById.mockResolvedValue({
         userId: 'user123',
         id: accessTokenId,
         sign: 'VALID_SIGN',
@@ -97,7 +101,7 @@ describe('AccessTokenService', () => {
       const expiredTime = new Date(Date.now() - 1500); // Expired 1 second ago
 
       // Mock PrismaService response
-      prismaService.accessToken.findUniqueOrThrow.mockResolvedValue({
+      accessTokenModel.getAccessTokenRawById.mockResolvedValue({
         userId: 'user123',
         id: accessTokenId,
         sign,

apps/nestjs-backend/src/features/access-token/access-token.service.ts

@@ -8,14 +8,19 @@ import type {
   UpdateAccessTokenRo,
 } from '@teable/openapi';
 import { ClsService } from 'nestjs-cls';
+import { PerformanceCacheService } from '../../performance-cache';
+import { generateAccessTokenCacheKey } from '../../performance-cache/generate-keys';
 import type { IClsStore } from '../../types/cls';
+import { AccessTokenModel } from '../model/access-token';
 import { getAccessToken } from './access-token.encryptor';
 
 @Injectable()
 export class AccessTokenService {
   constructor(
     private readonly prismaService: PrismaService,
-    private readonly cls: ClsService<IClsStore>
+    private readonly cls: ClsService<IClsStore>,
+    private readonly accessTokenModel: AccessTokenModel,
+    private readonly performanceCacheService: PerformanceCacheService
   ) {}
 
   private transformAccessTokenEntity<
@@ -55,24 +60,18 @@ export class AccessTokenService {
 
   async validate(splitAccessTokenObj: { accessTokenId: string; sign: string }) {
     const { accessTokenId, sign } = splitAccessTokenObj;
-    const accessTokenEntity = await this.prismaService.accessToken
-      .findUniqueOrThrow({
-        where: { id: accessTokenId },
-        select: {
-          userId: true,
-          id: true,
-          sign: true,
-          expiredTime: true,
-        },
-      })
-      .catch(() => {
-        throw new UnauthorizedException('token not found');
-      });
+    const accessTokenEntity = await this.accessTokenModel.getAccessTokenRawById(accessTokenId);
+    if (!accessTokenEntity) {
+      throw new UnauthorizedException('token not found');
+    }
     if (sign !== accessTokenEntity.sign) {
       throw new UnauthorizedException('sign error');
     }
     // expiredTime 1ms tolerance
-    if (accessTokenEntity.expiredTime.getTime() < Date.now() + 1000) {
+    if (
+      accessTokenEntity.expiredTime &&
+      new Date(accessTokenEntity.expiredTime).getTime() < Date.now() + 1000
+    ) {
       throw new UnauthorizedException('token expired');
     }
     await this.prismaService.accessToken.update({
@@ -177,6 +176,7 @@ export class AccessTokenService {
         lastUsedTime: true,
       },
     });
+    await this.performanceCacheService.del(generateAccessTokenCacheKey(id));
     return {
       ...this.transformAccessTokenEntity(accessTokenEntity),
       token: getAccessToken(id, sign),
@@ -206,6 +206,7 @@ export class AccessTokenService {
         hasFullAccess: true,
       },
     });
+    await this.performanceCacheService.del(generateAccessTokenCacheKey(id));
     return this.transformAccessTokenEntity(accessTokenEntity);
   }
 

apps/nestjs-backend/src/features/aggregation/open-api/aggregation-open-api.module.ts

@@ -1,12 +1,11 @@
 import { Module } from '@nestjs/common';
-import { PerformanceCacheModule } from '../../../performance-cache';
 import { AggregationModule } from '../aggregation.module';
 import { AggregationOpenApiController } from './aggregation-open-api.controller';
 import { AggregationOpenApiService } from './aggregation-open-api.service';
 
 @Module({
   controllers: [AggregationOpenApiController],
-  imports: [AggregationModule, PerformanceCacheModule],
+  imports: [AggregationModule],
   providers: [AggregationOpenApiService],
   exports: [AggregationOpenApiService],
 })

apps/nestjs-backend/src/features/auth/permission.service.spec.ts

@@ -10,6 +10,7 @@ import { noop } from 'lodash';
 import { ClsService } from 'nestjs-cls';
 import type { DeepMockProxy } from 'vitest-mock-extended';
 import { mockDeep, mockReset } from 'vitest-mock-extended';
+import { GlobalModule } from '../../global/global.module';
 import type { IClsStore } from '../../types/cls';
 import { PermissionService } from './permission.service';
 
@@ -23,6 +24,7 @@ describe('PermissionService', () => {
     clsServiceMock = mockDeep<ClsService<IClsStore>>();
 
     const module: TestingModule = await Test.createTestingModule({
+      imports: [GlobalModule],
       providers: [PermissionService, PrismaService, ClsService],
     })
       .overrideProvider(PrismaService)

apps/nestjs-backend/src/features/auth/permission.service.ts

@@ -7,30 +7,35 @@ import { intersection, union } from 'lodash';
 import { ClsService } from 'nestjs-cls';
 import type { IClsStore } from '../../types/cls';
 import { getMaxLevelRole } from '../../utils/get-max-level-role';
+import { CollaboratorModel } from '../model/collaborator';
 
 @Injectable()
 export class PermissionService {
   constructor(
     private readonly prismaService: PrismaService,
-    private readonly cls: ClsService<IClsStore>
+    private readonly cls: ClsService<IClsStore>,
+    private readonly collaboratorModel: CollaboratorModel
   ) {}
 
   private getDepartmentIds() {
     const departments = this.cls.get('organization.departments');
     return departments?.map((department) => department.id) || [];
   }
 
+  async getSpaceCollaborators(spaceId: string, principalId: string[]) {
+    const collaborators = await this.collaboratorModel.getCollaboratorRawByResourceId(spaceId);
+    return collaborators.filter((collaborator) => principalId.includes(collaborator.principalId));
+  }
+
+  async getBaseCollaborators(baseId: string, principalId: string[]) {
+    const collaborators = await this.collaboratorModel.getCollaboratorRawByResourceId(baseId);
+    return collaborators.filter((collaborator) => principalId.includes(collaborator.principalId));
+  }
+
   async getRoleBySpaceId(spaceId: string, includeInactiveResource?: boolean) {
     const userId = this.cls.get('user.id');
     const departmentIds = this.getDepartmentIds();
-    const collaborators = await this.prismaService.collaborator.findMany({
-      where: {
-        principalId: { in: [...departmentIds, userId] },
-        resourceId: spaceId,
-        resourceType: CollaboratorType.Space,
-      },
-      select: { roleName: true },
-    });
+    const collaborators = await this.getSpaceCollaborators(spaceId, [...departmentIds, userId]);
     const space = await this.prismaService.space.findFirst({
       where: {
         id: spaceId,
@@ -52,14 +57,7 @@ export class PermissionService {
     const departmentIds = this.getDepartmentIds();
     const userId = this.cls.get('user.id');
 
-    const collaborators = await this.prismaService.collaborator.findMany({
-      where: {
-        principalId: { in: [...departmentIds, userId] },
-        resourceId: baseId,
-        resourceType: CollaboratorType.Base,
-      },
-      select: { roleName: true },
-    });
+    const collaborators = await this.getBaseCollaborators(baseId, [...departmentIds, userId]);
     if (!collaborators.length) {
       return null;
     }

apps/nestjs-backend/src/features/auth/strategies/access-token.strategy.ts

@@ -27,7 +27,6 @@ export class AccessTokenStrategy extends PassportStrategy(PassportAccessTokenStr
 
   async validate(payload: { accessTokenId: string; sign: string }) {
     const { userId, accessTokenId } = await this.accessTokenService.validate(payload);
-
     const user = await this.userService.getUserById(userId);
     if (!user) {
       throw new UnauthorizedException('User not found');

apps/nestjs-backend/src/features/auth/utils.ts

@@ -3,12 +3,12 @@ import { type IUserMeVo } from '@teable/openapi';
 import { pick } from 'lodash';
 import { getPublicFullStorageUrl } from '../attachments/plugins/utils';
 
-export const pickUserMe = (
-  user: Pick<
-    Prisma.UserGetPayload<null>,
-    'id' | 'name' | 'avatar' | 'phone' | 'email' | 'password' | 'notifyMeta' | 'isAdmin'
-  >
-): IUserMeVo => {
+export type IPickUserMe = Pick<
+  Prisma.UserGetPayload<null>,
+  'id' | 'name' | 'avatar' | 'phone' | 'email' | 'password' | 'notifyMeta' | 'isAdmin'
+>;
+
+export const pickUserMe = (user: IPickUserMe): IUserMeVo => {
   return {
     ...pick(user, 'id', 'name', 'phone', 'email', 'isAdmin'),
     notifyMeta: typeof user.notifyMeta === 'object' ? user.notifyMeta : JSON.parse(user.notifyMeta),

apps/nestjs-backend/src/features/collaborator/collaborator.service.spec.ts

@@ -82,7 +82,7 @@ describe('CollaboratorService', () => {
           resourceType: CollaboratorType.Base,
         },
       });
-      expect(prismaService.$executeRawUnsafe).toBeCalled();
+      expect(prismaService.collaborator.createMany).toBeCalled();
     });
 
     it('should throw error if exists', async () => {

apps/nestjs-backend/src/features/collaborator/collaborator.service.ts

@@ -84,22 +84,17 @@ export class CollaboratorService {
       },
     });
 
-    const query = this.knex
-      .insert(
-        collaborators.map((collaborator) => ({
-          id: getRandomString(16),
-          resource_id: spaceId,
-          resource_type: CollaboratorType.Space,
-          role_name: role,
-          principal_id: collaborator.principalId,
-          principal_type: collaborator.principalType,
-          created_by: currentUserId!,
-        }))
-      )
-      .into('collaborator')
-      .toQuery();
-
-    await this.prismaService.txClient().$executeRawUnsafe(query);
+    await this.prismaService.txClient().collaborator.createMany({
+      data: collaborators.map((collaborator) => ({
+        id: getRandomString(16),
+        resourceId: spaceId,
+        resourceType: CollaboratorType.Space,
+        roleName: role,
+        principalId: collaborator.principalId,
+        principalType: collaborator.principalType,
+        createdBy: currentUserId!,
+      })),
+    });
     this.eventEmitterService.emitAsync(
       Events.COLLABORATOR_CREATE,
       new CollaboratorCreateEvent(spaceId)
@@ -722,22 +717,17 @@ export class CollaboratorService {
       throw new BadRequestException('has already existed in base');
     }
 
-    const query = this.knex
-      .insert(
-        collaborators.map((collaborator) => ({
-          id: getRandomString(16),
-          resource_id: baseId,
-          resource_type: CollaboratorType.Base,
-          role_name: role,
-          principal_id: collaborator.principalId,
-          principal_type: collaborator.principalType,
-          created_by: currentUserId!,
-        }))
-      )
-      .into('collaborator')
-      .toQuery();
-
-    const res = await this.prismaService.txClient().$executeRawUnsafe(query);
+    const res = await this.prismaService.txClient().collaborator.createMany({
+      data: collaborators.map((collaborator) => ({
+        id: getRandomString(16),
+        resourceId: baseId,
+        resourceType: CollaboratorType.Base,
+        roleName: role,
+        principalId: collaborator.principalId,
+        principalType: collaborator.principalType,
+        createdBy: currentUserId!,
+      })),
+    });
     this.eventEmitterService.emitAsync(
       Events.COLLABORATOR_CREATE,
       new CollaboratorCreateEvent(base.spaceId)

apps/nestjs-backend/src/features/model/access-token.ts

@@ -0,0 +1,28 @@
+import { Injectable } from '@nestjs/common';
+import { PrismaService } from '@teable/db-main-prisma';
+import { PerformanceCache, PerformanceCacheService } from '../../performance-cache';
+import { generateAccessTokenCacheKey } from '../../performance-cache/generate-keys';
+import { dateToIso } from '../../utils/date-to-iso';
+
+@Injectable()
+export class AccessTokenModel {
+  constructor(
+    private readonly prismaService: PrismaService,
+    protected readonly performanceCacheService: PerformanceCacheService
+  ) {}
+
+  @PerformanceCache({
+    ttl: 60 * 5,
+    keyGenerator: generateAccessTokenCacheKey,
+    statsType: 'access-token',
+  })
+  async getAccessTokenRawById(id: string) {
+    const res = await this.prismaService.txClient().accessToken.findUnique({
+      where: { id },
+    });
+    if (!res) {
+      return null;
+    }
+    return dateToIso(res);
+  }
+}