forked from Yara724/api
621 lines
19 KiB
TypeScript
621 lines
19 KiB
TypeScript
import { HttpService } from "@nestjs/axios";
|
|
import {
|
|
BadGatewayException,
|
|
HttpException,
|
|
Injectable,
|
|
Logger,
|
|
ServiceUnavailableException,
|
|
} from "@nestjs/common";
|
|
import { InjectModel } from "@nestjs/mongoose";
|
|
import { isAxiosError } from "axios";
|
|
import { Model } from "mongoose";
|
|
import { firstValueFrom } from "rxjs";
|
|
import {
|
|
getFanavaranClientProfile,
|
|
type FanavaranAuthConfig,
|
|
type FanavaranClientKey,
|
|
} from "src/core/config/fanavaran-client.config";
|
|
import { FanavaranAuditService } from "./fanavaran-audit.service";
|
|
import type { FanavaranAuditSession } from "./fanavaran-audit.types";
|
|
import {
|
|
FanavaranAuditStatus,
|
|
FanavaranAuditStep,
|
|
} from "./schema/fanavaran-audit-log.schema";
|
|
import {
|
|
FanavaranAuthToken,
|
|
FanavaranAuthTokenDocument,
|
|
} from "./schema/fanavaran-auth-token.schema";
|
|
|
|
interface CachedFanavaranAuth {
|
|
authenticationToken: string;
|
|
/** Epoch ms when the cached token should be refreshed. */
|
|
expiresAt: number;
|
|
/** Hash of auth fields used when this token was obtained. */
|
|
authFingerprint: string;
|
|
}
|
|
|
|
interface TenantBackoffState {
|
|
until: number;
|
|
reason: string;
|
|
}
|
|
|
|
/** Shared Fanavaran auth: one AppToken+Login per tenant, reused until TTL / backoff. */
|
|
@Injectable()
|
|
export class FanavaranAuthService {
|
|
private readonly logger = new Logger(FanavaranAuthService.name);
|
|
|
|
private readonly getAppTokenUrl =
|
|
"https://apimanager.iraneit.com/BimeApiManager/api/EITAuthentication/GetAppToken";
|
|
private readonly loginUrl =
|
|
"https://apimanager.iraneit.com/BimeApiManager/api/EITAuthentication/Login";
|
|
|
|
/** When Fanavaran says "try again later", pause all tenant calls. */
|
|
static readonly TRANSIENT_BACKOFF_MS = 5 * 60 * 1000;
|
|
|
|
/**
|
|
* Fanavaran authenticationToken is valid until local midnight (Asia/Tehran).
|
|
* First call after 00:00 gets a fresh token; daytime calls reuse the cache.
|
|
*/
|
|
static readonly TOKEN_TIME_ZONE = "Asia/Tehran";
|
|
|
|
private readonly tokenCache = new Map<FanavaranClientKey, CachedFanavaranAuth>();
|
|
private readonly inflightLogin = new Map<
|
|
FanavaranClientKey,
|
|
Promise<string>
|
|
>();
|
|
private readonly backoffByTenant = new Map<
|
|
FanavaranClientKey,
|
|
TenantBackoffState
|
|
>();
|
|
|
|
constructor(
|
|
private readonly httpService: HttpService,
|
|
private readonly fanavaranAuditService: FanavaranAuditService,
|
|
@InjectModel(FanavaranAuthToken.name)
|
|
private readonly authTokenModel: Model<FanavaranAuthTokenDocument>,
|
|
) {}
|
|
|
|
/** True when Fanavaran asked us to wait (Persian “try again later” / tracking-code 500). */
|
|
static isTransientTryLaterError(errorOrMessage: unknown): boolean {
|
|
const message = FanavaranAuthService.extractMessage(errorOrMessage);
|
|
if (!message) return false;
|
|
return (
|
|
message.includes("لطفا پس از چند لحظه مجدد تلاش") ||
|
|
message.includes("مجدد تلاش فرمایید") ||
|
|
/try again later/i.test(message)
|
|
);
|
|
}
|
|
|
|
static extractMessage(errorOrMessage: unknown): string {
|
|
if (typeof errorOrMessage === "string") return errorOrMessage;
|
|
if (isAxiosError(errorOrMessage)) {
|
|
const data = errorOrMessage.response?.data as
|
|
| { Message?: string; message?: string }
|
|
| string
|
|
| undefined;
|
|
if (typeof data === "string") return data;
|
|
return (
|
|
data?.Message ||
|
|
data?.message ||
|
|
errorOrMessage.message ||
|
|
""
|
|
);
|
|
}
|
|
if (errorOrMessage instanceof Error) return errorOrMessage.message;
|
|
return errorOrMessage == null ? "" : String(errorOrMessage);
|
|
}
|
|
|
|
/**
|
|
* Epoch ms of the next 00:00:00 in Asia/Tehran after `now`.
|
|
* If `now` is exactly midnight Tehran, returns the following midnight.
|
|
*/
|
|
static getNextMidnightExpiryMs(
|
|
nowMs: number = Date.now(),
|
|
timeZone: string = FanavaranAuthService.TOKEN_TIME_ZONE,
|
|
): number {
|
|
const parts = Object.fromEntries(
|
|
new Intl.DateTimeFormat("en-US", {
|
|
timeZone,
|
|
year: "numeric",
|
|
month: "2-digit",
|
|
day: "2-digit",
|
|
hour: "2-digit",
|
|
minute: "2-digit",
|
|
second: "2-digit",
|
|
hourCycle: "h23",
|
|
})
|
|
.formatToParts(new Date(nowMs))
|
|
.filter((p) => p.type !== "literal")
|
|
.map((p) => [p.type, p.value]),
|
|
) as Record<string, string>;
|
|
|
|
const hour = Number(parts.hour);
|
|
const minute = Number(parts.minute);
|
|
const second = Number(parts.second);
|
|
const msIntoDay = ((hour * 60 + minute) * 60 + second) * 1000;
|
|
const msPerDay = 24 * 60 * 60 * 1000;
|
|
const remaining = msPerDay - msIntoDay;
|
|
// Exactly at midnight → treat as expired for current day; expire at next midnight.
|
|
return nowMs + (remaining === 0 ? msPerDay : remaining);
|
|
}
|
|
|
|
getBackoffRemainingMs(clientKey: FanavaranClientKey): number {
|
|
const state = this.backoffByTenant.get(clientKey);
|
|
if (!state) return 0;
|
|
return Math.max(0, state.until - Date.now());
|
|
}
|
|
|
|
isInBackoff(clientKey: FanavaranClientKey): boolean {
|
|
return this.getBackoffRemainingMs(clientKey) > 0;
|
|
}
|
|
|
|
/**
|
|
* Call after any Fanavaran HTTP failure. Sets a tenant-wide pause when the
|
|
* error is the familiar “try again later” overload response.
|
|
*/
|
|
registerFailure(clientKey: FanavaranClientKey, error: unknown): void {
|
|
if (!FanavaranAuthService.isTransientTryLaterError(error)) return;
|
|
|
|
const until = Date.now() + FanavaranAuthService.TRANSIENT_BACKOFF_MS;
|
|
const reason = FanavaranAuthService.extractMessage(error).slice(0, 500);
|
|
this.backoffByTenant.set(clientKey, { until, reason });
|
|
// Token may still be valid, but Fanavaran is rejecting work — keep token,
|
|
// just stop hammering Login/business APIs.
|
|
this.logger.warn(
|
|
`[${clientKey}] Fanavaran transient backoff until ${new Date(until).toISOString()}: ${reason}`,
|
|
);
|
|
}
|
|
|
|
clearBackoff(clientKey: FanavaranClientKey): void {
|
|
this.backoffByTenant.delete(clientKey);
|
|
}
|
|
|
|
invalidateToken(clientKey: FanavaranClientKey): void {
|
|
this.tokenCache.delete(clientKey);
|
|
void this.authTokenModel.deleteOne({ clientKey }).exec().catch((error) => {
|
|
this.logger.warn(
|
|
`[${clientKey}] Failed to clear persisted Fanavaran auth token`,
|
|
error,
|
|
);
|
|
});
|
|
}
|
|
|
|
/**
|
|
* Stable fingerprint of tenant auth. Any change (location, credentials, …)
|
|
* forces a fresh GetAppToken+Login even before Tehran midnight.
|
|
*/
|
|
static authFingerprint(auth: FanavaranAuthConfig): string {
|
|
return [
|
|
auth.appName,
|
|
auth.secret,
|
|
auth.username,
|
|
auth.password,
|
|
auth.corpId,
|
|
auth.contractId,
|
|
auth.location,
|
|
].join("|");
|
|
}
|
|
|
|
assertNotInBackoff(clientKey: FanavaranClientKey): void {
|
|
const remaining = this.getBackoffRemainingMs(clientKey);
|
|
if (remaining <= 0) return;
|
|
const state = this.backoffByTenant.get(clientKey);
|
|
throw new ServiceUnavailableException(
|
|
`Fanavaran tenant "${clientKey}" is in backoff for ${Math.ceil(remaining / 1000)}s after transient errors. ${state?.reason ?? ""}`.trim(),
|
|
);
|
|
}
|
|
|
|
async getAuthenticationToken(
|
|
clientKey: FanavaranClientKey,
|
|
options?: {
|
|
auditSession?: FanavaranAuditSession;
|
|
forceRefresh?: boolean;
|
|
},
|
|
): Promise<string> {
|
|
this.assertNotInBackoff(clientKey);
|
|
const fingerprint = FanavaranAuthService.authFingerprint(
|
|
getFanavaranClientProfile(clientKey).auth,
|
|
);
|
|
|
|
if (!options?.forceRefresh) {
|
|
const memoryHit = this.readMemoryCache(clientKey, fingerprint);
|
|
if (memoryHit) {
|
|
return memoryHit;
|
|
}
|
|
const persisted = await this.readPersistedCache(clientKey, fingerprint);
|
|
if (persisted) {
|
|
return persisted;
|
|
}
|
|
} else {
|
|
this.invalidateToken(clientKey);
|
|
}
|
|
|
|
const existing = this.inflightLogin.get(clientKey);
|
|
if (existing) {
|
|
return existing;
|
|
}
|
|
|
|
const loginPromise = this.loginFresh(clientKey, options?.auditSession);
|
|
this.inflightLogin.set(clientKey, loginPromise);
|
|
try {
|
|
return await loginPromise;
|
|
} finally {
|
|
this.inflightLogin.delete(clientKey);
|
|
}
|
|
}
|
|
|
|
async getRequestHeaders(
|
|
clientKey: FanavaranClientKey,
|
|
options?: {
|
|
auditSession?: FanavaranAuditSession;
|
|
forceRefresh?: boolean;
|
|
},
|
|
): Promise<{
|
|
authenticationToken: string;
|
|
CorpId: string;
|
|
ContractId: string;
|
|
Location: string;
|
|
}> {
|
|
const profile = getFanavaranClientProfile(clientKey);
|
|
const authenticationToken = await this.getAuthenticationToken(
|
|
clientKey,
|
|
options,
|
|
);
|
|
return {
|
|
authenticationToken,
|
|
CorpId: profile.auth.corpId,
|
|
ContractId: profile.auth.contractId,
|
|
Location: profile.auth.location,
|
|
};
|
|
}
|
|
|
|
private async loginFresh(
|
|
clientKey: FanavaranClientKey,
|
|
auditSession?: FanavaranAuditSession,
|
|
): Promise<string> {
|
|
const profile = getFanavaranClientProfile(clientKey);
|
|
const fingerprint = FanavaranAuthService.authFingerprint(profile.auth);
|
|
const appToken = await this.fetchAppToken(profile.auth, auditSession);
|
|
const authenticationToken = await this.fetchLoginToken(
|
|
appToken,
|
|
profile.auth,
|
|
auditSession,
|
|
);
|
|
|
|
const expiresAt = FanavaranAuthService.getNextMidnightExpiryMs();
|
|
await this.persistToken(
|
|
clientKey,
|
|
authenticationToken,
|
|
expiresAt,
|
|
fingerprint,
|
|
);
|
|
this.clearBackoff(clientKey);
|
|
this.logger.log(
|
|
`[${clientKey}] Cached Fanavaran authenticationToken until ${new Date(
|
|
expiresAt,
|
|
).toISOString()} (${FanavaranAuthService.TOKEN_TIME_ZONE} midnight)`,
|
|
);
|
|
return authenticationToken;
|
|
}
|
|
|
|
private readMemoryCache(
|
|
clientKey: FanavaranClientKey,
|
|
fingerprint: string,
|
|
): string | null {
|
|
const cached = this.tokenCache.get(clientKey);
|
|
if (!cached) {
|
|
return null;
|
|
}
|
|
if (cached.authFingerprint !== fingerprint) {
|
|
this.logger.log(
|
|
`[${clientKey}] Auth config changed — discarding in-memory Fanavaran token`,
|
|
);
|
|
this.tokenCache.delete(clientKey);
|
|
return null;
|
|
}
|
|
if (cached.expiresAt > Date.now()) {
|
|
return cached.authenticationToken;
|
|
}
|
|
this.tokenCache.delete(clientKey);
|
|
return null;
|
|
}
|
|
|
|
private async readPersistedCache(
|
|
clientKey: FanavaranClientKey,
|
|
fingerprint: string,
|
|
): Promise<string | null> {
|
|
try {
|
|
const doc = await this.authTokenModel.findOne({ clientKey }).lean().exec();
|
|
if (!doc?.authenticationToken || !doc.expiresAt) {
|
|
return null;
|
|
}
|
|
if (!doc.authFingerprint || doc.authFingerprint !== fingerprint) {
|
|
this.logger.log(
|
|
`[${clientKey}] Auth config changed (or legacy token without fingerprint) — discarding persisted Fanavaran token`,
|
|
);
|
|
await this.authTokenModel.deleteOne({ clientKey }).exec();
|
|
return null;
|
|
}
|
|
const expiresAt = new Date(doc.expiresAt).getTime();
|
|
if (!(expiresAt > Date.now())) {
|
|
await this.authTokenModel.deleteOne({ clientKey }).exec();
|
|
return null;
|
|
}
|
|
this.tokenCache.set(clientKey, {
|
|
authenticationToken: doc.authenticationToken,
|
|
expiresAt,
|
|
authFingerprint: doc.authFingerprint,
|
|
});
|
|
this.logger.log(
|
|
`[${clientKey}] Reused persisted Fanavaran authenticationToken until ${new Date(
|
|
expiresAt,
|
|
).toISOString()}`,
|
|
);
|
|
return doc.authenticationToken;
|
|
} catch (error) {
|
|
this.logger.warn(
|
|
`[${clientKey}] Failed to read persisted Fanavaran auth token`,
|
|
error,
|
|
);
|
|
return null;
|
|
}
|
|
}
|
|
|
|
private async persistToken(
|
|
clientKey: FanavaranClientKey,
|
|
authenticationToken: string,
|
|
expiresAt: number,
|
|
authFingerprint: string,
|
|
): Promise<void> {
|
|
this.tokenCache.set(clientKey, {
|
|
authenticationToken,
|
|
expiresAt,
|
|
authFingerprint,
|
|
});
|
|
try {
|
|
await this.authTokenModel
|
|
.findOneAndUpdate(
|
|
{ clientKey },
|
|
{
|
|
$set: {
|
|
authenticationToken,
|
|
expiresAt: new Date(expiresAt),
|
|
authFingerprint,
|
|
},
|
|
},
|
|
{ upsert: true, new: true },
|
|
)
|
|
.exec();
|
|
} catch (error) {
|
|
this.logger.warn(
|
|
`[${clientKey}] Failed to persist Fanavaran auth token (memory cache still active)`,
|
|
error,
|
|
);
|
|
}
|
|
}
|
|
|
|
private emptyBodyTransformRequest() {
|
|
return [
|
|
(_data: unknown, headers?: Record<string, unknown>) => {
|
|
if (headers) {
|
|
delete headers["Content-Type"];
|
|
delete headers["content-type"];
|
|
}
|
|
return _data;
|
|
},
|
|
];
|
|
}
|
|
|
|
private async fetchAppToken(
|
|
config: Pick<FanavaranAuthConfig, "appName" | "secret">,
|
|
auditSession?: FanavaranAuditSession,
|
|
): Promise<string> {
|
|
const startedAt = Date.now();
|
|
const requestHeaders = {
|
|
appname: config.appName,
|
|
secret: config.secret,
|
|
"Content-Length": "0",
|
|
};
|
|
if (auditSession) {
|
|
await this.fanavaranAuditService.recordStep({
|
|
session: auditSession,
|
|
step: FanavaranAuditStep.GET_APP_TOKEN,
|
|
status: FanavaranAuditStatus.STARTED,
|
|
requestUrl: this.getAppTokenUrl,
|
|
requestMethod: "POST",
|
|
requestHeaders,
|
|
requestBody: "",
|
|
requestMeta: { appName: config.appName, cached: false },
|
|
});
|
|
}
|
|
|
|
try {
|
|
const response = await firstValueFrom(
|
|
this.httpService.post(this.getAppTokenUrl, "", {
|
|
headers: requestHeaders,
|
|
transformRequest: this.emptyBodyTransformRequest(),
|
|
}),
|
|
);
|
|
|
|
const appToken =
|
|
response.headers.apptoken ||
|
|
response.headers.appToken ||
|
|
response.headers["apptoken"] ||
|
|
response.headers["appToken"];
|
|
|
|
if (!appToken) {
|
|
throw new BadGatewayException("Failed to get Fanavaran appToken");
|
|
}
|
|
|
|
if (auditSession) {
|
|
const exchange =
|
|
this.fanavaranAuditService.captureAxiosExchange(
|
|
response,
|
|
requestHeaders,
|
|
);
|
|
await this.fanavaranAuditService.recordStep({
|
|
session: auditSession,
|
|
step: FanavaranAuditStep.GET_APP_TOKEN,
|
|
status: FanavaranAuditStatus.SUCCESS,
|
|
requestUrl: this.getAppTokenUrl,
|
|
requestMethod: "POST",
|
|
httpStatus: response.status,
|
|
requestHeaders: exchange.requestHeaders,
|
|
requestBody: "",
|
|
responseHeaders: exchange.responseHeaders,
|
|
responseBody: exchange.responseBody,
|
|
responseMeta: { hasAppToken: true, cached: false },
|
|
durationMs: Date.now() - startedAt,
|
|
});
|
|
}
|
|
|
|
return appToken;
|
|
} catch (error) {
|
|
if (auditSession) {
|
|
const exchange = this.fanavaranAuditService.captureAxiosExchange(
|
|
error,
|
|
requestHeaders,
|
|
);
|
|
await this.fanavaranAuditService.recordStep({
|
|
session: auditSession,
|
|
step: FanavaranAuditStep.GET_APP_TOKEN,
|
|
status: FanavaranAuditStatus.FAILURE,
|
|
requestUrl: this.getAppTokenUrl,
|
|
requestMethod: "POST",
|
|
httpStatus: exchange.httpStatus,
|
|
requestHeaders: exchange.requestHeaders,
|
|
requestBody: "",
|
|
responseHeaders: exchange.responseHeaders,
|
|
responseBody: exchange.responseBody,
|
|
errorMessage: this.fanavaranAuditService.extractErrorMessage(error),
|
|
errorDetails: this.fanavaranAuditService.sanitizeErrorDetails(error),
|
|
durationMs: Date.now() - startedAt,
|
|
});
|
|
}
|
|
throw this.toGatewayError(error, "Failed to get appToken from external API", auditSession);
|
|
}
|
|
}
|
|
|
|
private async fetchLoginToken(
|
|
appToken: string,
|
|
config: Pick<FanavaranAuthConfig, "username" | "password">,
|
|
auditSession?: FanavaranAuditSession,
|
|
): Promise<string> {
|
|
const startedAt = Date.now();
|
|
const requestHeaders = {
|
|
appToken,
|
|
userName: config.username,
|
|
password: config.password,
|
|
"Content-Length": "0",
|
|
};
|
|
if (auditSession) {
|
|
await this.fanavaranAuditService.recordStep({
|
|
session: auditSession,
|
|
step: FanavaranAuditStep.LOGIN,
|
|
status: FanavaranAuditStatus.STARTED,
|
|
requestUrl: this.loginUrl,
|
|
requestMethod: "POST",
|
|
requestHeaders,
|
|
requestBody: "",
|
|
requestMeta: { userName: config.username, cached: false },
|
|
});
|
|
}
|
|
|
|
try {
|
|
const response = await firstValueFrom(
|
|
this.httpService.post(this.loginUrl, "", {
|
|
headers: requestHeaders,
|
|
transformRequest: this.emptyBodyTransformRequest(),
|
|
}),
|
|
);
|
|
|
|
const authenticationToken =
|
|
response.headers.authenticationtoken ||
|
|
response.headers.authenticationToken ||
|
|
response.headers["authenticationtoken"] ||
|
|
response.headers["authenticationToken"] ||
|
|
response.data?.authenticationtoken ||
|
|
response.data?.authenticationToken ||
|
|
response.data?.authentication_token;
|
|
|
|
if (!authenticationToken) {
|
|
throw new BadGatewayException(
|
|
"Failed to get Fanavaran authenticationToken",
|
|
);
|
|
}
|
|
|
|
if (auditSession) {
|
|
const exchange =
|
|
this.fanavaranAuditService.captureAxiosExchange(
|
|
response,
|
|
requestHeaders,
|
|
);
|
|
await this.fanavaranAuditService.recordStep({
|
|
session: auditSession,
|
|
step: FanavaranAuditStep.LOGIN,
|
|
status: FanavaranAuditStatus.SUCCESS,
|
|
requestUrl: this.loginUrl,
|
|
requestMethod: "POST",
|
|
httpStatus: response.status,
|
|
requestHeaders: exchange.requestHeaders,
|
|
requestBody: "",
|
|
responseHeaders: exchange.responseHeaders,
|
|
responseBody: exchange.responseBody,
|
|
responseMeta: {
|
|
hasAuthenticationToken: true,
|
|
cached: false,
|
|
},
|
|
durationMs: Date.now() - startedAt,
|
|
});
|
|
}
|
|
|
|
return authenticationToken;
|
|
} catch (error) {
|
|
if (auditSession) {
|
|
const exchange = this.fanavaranAuditService.captureAxiosExchange(
|
|
error,
|
|
requestHeaders,
|
|
);
|
|
await this.fanavaranAuditService.recordStep({
|
|
session: auditSession,
|
|
step: FanavaranAuditStep.LOGIN,
|
|
status: FanavaranAuditStatus.FAILURE,
|
|
requestUrl: this.loginUrl,
|
|
requestMethod: "POST",
|
|
httpStatus: exchange.httpStatus,
|
|
requestHeaders: exchange.requestHeaders,
|
|
requestBody: "",
|
|
responseHeaders: exchange.responseHeaders,
|
|
responseBody: exchange.responseBody,
|
|
errorMessage: this.fanavaranAuditService.extractErrorMessage(error),
|
|
errorDetails: this.fanavaranAuditService.sanitizeErrorDetails(error),
|
|
durationMs: Date.now() - startedAt,
|
|
});
|
|
}
|
|
throw this.toGatewayError(error, "Failed to login to external API", auditSession);
|
|
}
|
|
}
|
|
|
|
private toGatewayError(
|
|
error: unknown,
|
|
fallback: string,
|
|
auditSession?: FanavaranAuditSession,
|
|
): HttpException {
|
|
if (error instanceof HttpException) {
|
|
return error;
|
|
}
|
|
const message = isAxiosError(error)
|
|
? error.response?.data?.Message ||
|
|
error.response?.data?.message ||
|
|
error.message ||
|
|
fallback
|
|
: fallback;
|
|
return new BadGatewayException(
|
|
this.fanavaranAuditService.formatErrorWithTrackingCode(
|
|
String(message),
|
|
auditSession?.trackingCode,
|
|
),
|
|
);
|
|
}
|
|
}
|