Merge branch 'main' into feat/rs256-jwt-support

Author: aliyuHabibu

src/app.module.ts

@@ -3,6 +3,7 @@ import { APP_GUARD, APP_INTERCEPTOR, APP_FILTER } from '@nestjs/core';
 import { ConfigModule } from '@nestjs/config';
 import { TypeOrmModule } from '@nestjs/typeorm';
 import { ScheduleModule } from '@nestjs/schedule';
+import { envValidationSchema } from './config/env.validation';
 
 import { AppController } from './app.controller';
 import { SearchModule } from './search/search.module';
@@ -40,7 +41,11 @@ const featureFlags = loadFeatureFlags();
 
 @Module({
   imports: [
-    ConfigModule.forRoot({ isGlobal: true }),
+    ConfigModule.forRoot({
+      isGlobal: true,
+      validationSchema: envValidationSchema,
+      validationOptions: { abortEarly: false },
+    }),
     TypeOrmModule.forRoot(getDatabaseConfig()),
     ScheduleModule.forRoot(),
     SessionModule,

src/auth/auth.service.ts

@@ -39,7 +39,7 @@ export class AuthService {
     try {
       // Verify token signature and expiration
       decoded = this.jwtService.verify(refreshToken, {
-        secret: process.env.JWT_REFRESH_SECRET || 'default-refresh-secret',
+        secret: process.env.JWT_REFRESH_SECRET,
       });
     } catch (_e) {
       throw new UnauthorizedException('Invalid or expired refresh token');
@@ -118,20 +118,14 @@ export class AuthService {
     const refreshJti = uuidv4();
 
     const [accessToken, refreshToken] = await Promise.all([
-      isRS256Configured()
-        ? this.jwtService.signAsync(payload, {
-            privateKey: this.getPrivateKey(),
-            algorithm: 'RS256',
-            expiresIn: (process.env.JWT_EXPIRES_IN || '15m') as any,
-          })
-        : this.jwtService.signAsync(payload, {
-            secret: process.env.JWT_SECRET || 'default-jwt-secret',
-            expiresIn: (process.env.JWT_EXPIRES_IN || '15m') as any,
-          }),
+      this.jwtService.signAsync(payload, {
+        secret: process.env.JWT_SECRET,
+        expiresIn: (process.env.JWT_EXPIRES_IN || '15m') as any,
+      }),
       this.jwtService.signAsync(
         { ...payload, jti: refreshJti },
         {
-          secret: process.env.JWT_REFRESH_SECRET || 'default-refresh-secret',
+          secret: process.env.JWT_REFRESH_SECRET,
           expiresIn: (process.env.JWT_REFRESH_EXPIRES_IN || '7d') as any,
         },
       ),

src/config/env.validation.spec.ts

@@ -0,0 +1,72 @@
+import { envValidationSchema } from './env.validation';
+
+const validEnv = {
+  DATABASE_HOST: 'localhost',
+  DATABASE_PORT: '5432',
+  DATABASE_USER: 'teachlink',
+  DATABASE_PASSWORD: 'password',
+  DATABASE_NAME: 'teachlink',
+  REDIS_HOST: 'localhost',
+  REDIS_PORT: '6379',
+  JWT_SECRET: 'a-very-secret-jwt-key',
+  JWT_REFRESH_SECRET: 'a-very-secret-refresh-key',
+  ENCRYPTION_SECRET: 'a'.repeat(32),
+  STRIPE_SECRET_KEY: 'sk_test_123',
+  STRIPE_WEBHOOK_SECRET: 'whsec_123',
+  SMTP_HOST: 'smtp.example.com',
+  SMTP_PORT: '587',
+  SMTP_USER: 'user',
+  SMTP_PASS: 'pass',
+  EMAIL_FROM: 'noreply@example.com',
+  AWS_ACCESS_KEY_ID: 'AKIA123',
+  AWS_SECRET_ACCESS_KEY: 'secret',
+  AWS_S3_BUCKET: 'teachlink-bucket',
+  SENDGRID_API_KEY: 'SG.123',
+  SENDGRID_SENDER_EMAIL: 'sender@example.com',
+  SENDGRID_WEBHOOK_TOKEN: 'token',
+  SESSION_SECRET: 'a-very-secret-session-key',
+};
+
+function validate(env: Record<string, string | undefined>) {
+  return envValidationSchema.validate(env, { abortEarly: false });
+}
+
+describe('envValidationSchema', () => {
+  it('passes validation when all required vars are present and valid', () => {
+    const { error } = validate(validEnv);
+    expect(error).toBeUndefined();
+  });
+
+  it('fails startup when JWT_SECRET is missing', () => {
+    const { JWT_SECRET, ...envWithoutSecret } = validEnv;
+    const { error } = validate(envWithoutSecret);
+
+    expect(error).toBeDefined();
+    expect(error?.message).toContain('JWT_SECRET');
+  });
+
+  it('lists every missing required var in a single descriptive error', () => {
+    const { error } = validate({});
+
+    expect(error).toBeDefined();
+    const messages = error?.details.map((d) => d.message).join('\n') ?? '';
+    expect(messages).toContain('DATABASE_HOST');
+    expect(messages).toContain('REDIS_HOST');
+    expect(messages).toContain('JWT_REFRESH_SECRET');
+    expect(messages).toContain('ENCRYPTION_SECRET');
+  });
+
+  it('fails validation when ENCRYPTION_SECRET is shorter than 32 characters', () => {
+    const { error } = validate({ ...validEnv, ENCRYPTION_SECRET: 'too-short' });
+
+    expect(error).toBeDefined();
+    expect(error?.message).toContain('ENCRYPTION_SECRET');
+  });
+
+  it('allows JWT_SECRET to be omitted when JWT_SECRETS (rotation list) is set', () => {
+    const { JWT_SECRET, ...rest } = validEnv;
+    const { error } = validate({ ...rest, JWT_SECRETS: 'v1:secret-one,v2:secret-two' });
+
+    expect(error).toBeUndefined();
+  });
+});

src/orchestration/locks/distributed-lock.service.spec.ts

@@ -0,0 +1,118 @@
+jest.mock('ioredis', () => {
+  return jest.fn();
+});
+
+import Redis from 'ioredis';
+import { DistributedLockService } from './distributed-lock.service';
+
+describe('DistributedLockService', () => {
+  let store: Map<string, string>;
+  let setSpy: jest.Mock;
+  let evalSpy: jest.Mock;
+
+  beforeEach(() => {
+    store = new Map<string, string>();
+
+    setSpy = jest.fn(
+      async (key: string, value: string, mode: string, ttl: number, flag: string) => {
+        if (flag === 'NX' && store.has(key)) {
+          return null;
+        }
+        store.set(key, value);
+        return 'OK';
+      },
+    );
+
+    evalSpy = jest.fn(async (_script: string, _numKeys: number, key: string, token: string) => {
+      if (store.get(key) === token) {
+        store.delete(key);
+        return 1;
+      }
+      return 0;
+    });
+
+    (Redis as unknown as jest.Mock).mockImplementation(() => ({
+      on: jest.fn(),
+      set: setSpy,
+      del: jest.fn(async (key: string) => {
+        store.delete(key);
+        return 1;
+      }),
+      eval: evalSpy,
+    }));
+  });
+
+  it('acquires the lock using a single SET key value NX PX command', async () => {
+    const service = new DistributedLockService();
+
+    const token = await service.acquireLock('lock:test', 5000);
+
+    expect(token).not.toBeNull();
+    expect(setSpy).toHaveBeenCalledTimes(1);
+    expect(setSpy).toHaveBeenCalledWith('lock:test', token, 'PX', 5000, 'NX');
+  });
+
+  it('returns null when the lock is already held', async () => {
+    const service = new DistributedLockService();
+
+    const first = await service.acquireLock('lock:test', 5000);
+    const second = await service.acquireLock('lock:test', 5000);
+
+    expect(first).not.toBeNull();
+    expect(second).toBeNull();
+  });
+
+  it('allows exactly one caller to acquire the lock under 100 concurrent attempts', async () => {
+    const service = new DistributedLockService();
+
+    const results = await Promise.all(
+      Array.from({ length: 100 }, () => service.acquireLock('lock:contended', 5000)),
+    );
+
+    const winners = results.filter((token) => token !== null);
+    expect(winners).toHaveLength(1);
+  });
+
+  it('releaseLock only removes the lock if the token matches', async () => {
+    const service = new DistributedLockService();
+    const token = await service.acquireLock('lock:test', 5000);
+
+    await service.releaseLock('lock:test', 'wrong-token');
+    expect(await service.acquireLock('lock:test', 5000)).toBeNull();
+
+    await service.releaseLock('lock:test', token as string);
+    expect(await service.acquireLock('lock:test', 5000)).not.toBeNull();
+  });
+
+  it('withLock releases the lock even if fn throws', async () => {
+    const service = new DistributedLockService();
+
+    await expect(
+      service.withLock('lock:test', 5000, async () => {
+        throw new Error('boom');
+      }),
+    ).rejects.toThrow('boom');
+
+    // Lock must be free again — a fresh acquire should succeed immediately.
+    const token = await service.acquireLock('lock:test', 5000);
+    expect(token).not.toBeNull();
+  });
+
+  it('withLock returns the value produced by fn and releases the lock', async () => {
+    const service = new DistributedLockService();
+
+    const result = await service.withLock('lock:test', 5000, async () => 'done');
+
+    expect(result).toBe('done');
+    expect(await service.acquireLock('lock:test', 5000)).not.toBeNull();
+  });
+
+  it('withLock throws if the lock cannot be acquired', async () => {
+    const service = new DistributedLockService();
+    await service.acquireLock('lock:test', 5000);
+
+    await expect(service.withLock('lock:test', 5000, async () => 'unreachable')).rejects.toThrow(
+      'Could not acquire lock',
+    );
+  });
+});

src/orchestration/locks/distributed-lock.service.ts

@@ -1,5 +1,13 @@
 import { Injectable } from '@nestjs/common';
 import Redis from 'ioredis';
+import { randomUUID } from 'crypto';
+
+const RELEASE_SCRIPT = `
+  if redis.call('GET', KEYS[1]) == ARGV[1] then
+    return redis.call('DEL', KEYS[1])
+  end
+  return 0
+`;
 
 /**
  * Provides distributed Lock operations.
@@ -15,21 +23,43 @@ export class DistributedLockService {
   }
 
   /**
-   * Executes acquire Lock.
+   * Atomically acquires a lock via a single SET key value NX PX command,
+   * so two concurrent callers can never both believe they hold it.
    * @param key The key.
-   * @param ttl The ttl.
-   * @returns Whether the operation succeeded.
+   * @param ttl The ttl in milliseconds.
+   * @returns A unique token if acquired, or null if the lock is already held.
    */
-  async acquireLock(key: string, ttl = 5000): Promise<boolean> {
-    const result = await this.redis.set(key, 'locked', 'PX', ttl, 'NX');
-    return result === 'OK';
+  async acquireLock(key: string, ttl = 5000): Promise<string | null> {
+    const token = randomUUID();
+    const result = await this.redis.set(key, token, 'PX', ttl, 'NX');
+    return result === 'OK' ? token : null;
   }
 
   /**
-   * Executes release Lock.
+   * Releases the lock, but only if it is still held by this token. This
+   * prevents releasing a lock that has since expired and been acquired by
+   * another caller.
    * @param key The key.
+   * @param token The token returned by acquireLock.
+   */
+  async releaseLock(key: string, token: string): Promise<void> {
+    await this.redis.eval(RELEASE_SCRIPT, 1, key, token);
+  }
+
+  /**
+   * Acquires the lock, runs fn, and always releases the lock afterwards
+   * (even if fn throws). Throws if the lock cannot be acquired.
    */
-  async releaseLock(key: string): Promise<void> {
-    await this.redis.del(key);
+  async withLock<T>(key: string, ttl: number, fn: () => Promise<T>): Promise<T> {
+    const token = await this.acquireLock(key, ttl);
+    if (!token) {
+      throw new Error(`Could not acquire lock: ${key}`);
+    }
+
+    try {
+      return await fn();
+    } finally {
+      await this.releaseLock(key, token);
+    }
   }
 }