Build a URL Shortener: Authentication & User Management

// prisma/schema.prisma
 
model User {
  id          String    @id @default(uuid())
  email       String    @unique
  password    String    // bcrypt hash
  name        String?
  apiKey      String?   @unique @map("api_key")
  isActive    Boolean   @default(true) @map("is_active")
  createdAt   DateTime  @default(now()) @map("created_at")
  updatedAt   DateTime  @updatedAt @map("updated_at")
 
  urls          Url[]
  refreshTokens RefreshToken[]
 
  @@map("users")
}
 
model RefreshToken {
  id        String   @id @default(uuid())
  token     String   @unique
  userId    String   @map("user_id")
  expiresAt DateTime @map("expires_at")
  createdAt DateTime @default(now()) @map("created_at")
 
  user User @relation(fields: [userId], references: [id], onDelete: Cascade)
 
  @@index([token])
  @@index([userId])
  @@map("refresh_tokens")
}

model Url {
  id          String    @id @default(uuid())
  shortCode   String    @unique @map("short_code")
  originalUrl String    @map("original_url")
  clickCount  Int       @default(0) @map("click_count")
  userId      String?   @map("user_id")   // null = anonymous
  customAlias Boolean   @default(false) @map("custom_alias")
  expiresAt   DateTime? @map("expires_at")
  createdAt   DateTime  @default(now()) @map("created_at")
  updatedAt   DateTime  @updatedAt @map("updated_at")
 
  user User? @relation(fields: [userId], references: [id], onDelete: SetNull)
 
  @@index([shortCode])
  @@index([userId])
  @@map("urls")
}

npx prisma migrate dev --name add-users-and-auth

npm install bcrypt jsonwebtoken
npm install -D @types/bcrypt @types/jsonwebtoken

# Auth
JWT_ACCESS_SECRET=your-access-token-secret-change-in-production
JWT_REFRESH_SECRET=your-refresh-token-secret-change-in-production
JWT_ACCESS_EXPIRY=15m
JWT_REFRESH_EXPIRY=7d

// src/config/env.ts
 
import dotenv from 'dotenv';
 
dotenv.config();
 
export const env = {
  port: parseInt(process.env.PORT || '3000', 10),
  baseUrl: process.env.BASE_URL || 'http://localhost:3000',
  nodeEnv: process.env.NODE_ENV || 'development',
  databaseUrl: process.env.DATABASE_URL || '',
  redisUrl: process.env.REDIS_URL || 'redis://localhost:6379',
 
  // Auth
  jwtAccessSecret: process.env.JWT_ACCESS_SECRET || 'dev-access-secret',
  jwtRefreshSecret: process.env.JWT_REFRESH_SECRET || 'dev-refresh-secret',
  jwtAccessExpiry: process.env.JWT_ACCESS_EXPIRY || '15m',
  jwtRefreshExpiry: process.env.JWT_REFRESH_EXPIRY || '7d',
} as const;

// src/types/auth.ts
 
export interface RegisterRequest {
  email: string;
  password: string;
  name?: string;
}
 
export interface LoginRequest {
  email: string;
  password: string;
}
 
export interface AuthTokens {
  accessToken: string;
  refreshToken: string;
}
 
export interface TokenPayload {
  userId: string;
  email: string;
}
 
export interface AuthenticatedRequest {
  userId: string;
  email: string;
}
 
export interface UserResponse {
  id: string;
  email: string;
  name: string | null;
  createdAt: Date;
}
 
export interface ApiKeyResponse {
  apiKey: string;
}

// src/services/authService.ts
 
import bcrypt from 'bcrypt';
import jwt from 'jsonwebtoken';
import crypto from 'crypto';
import { PrismaClient } from '@prisma/client';
import { env } from '../config/env';
import { AppError } from './urlService';
import {
  RegisterRequest,
  LoginRequest,
  AuthTokens,
  TokenPayload,
  UserResponse,
} from '../types/auth';
 
const prisma = new PrismaClient();
 
const SALT_ROUNDS = 12;
 
export class AuthService {
  // ─── Registration ──────────────────────────────────────
 
  async register(data: RegisterRequest): Promise<UserResponse> {
    const { email, password, name } = data;
 
    // Kiểm tra email đã tồn tại chưa
    const existing = await prisma.user.findUnique({
      where: { email: email.toLowerCase() },
    });
 
    if (existing) {
      throw new AppError('Email is already registered', 409);
    }
 
    // Validate password strength
    this.validatePassword(password);
 
    // Hash password
    const hashedPassword = await bcrypt.hash(password, SALT_ROUNDS);
 
    // Tạo user
    const user = await prisma.user.create({
      data: {
        email: email.toLowerCase(),
        password: hashedPassword,
        name: name || null,
      },
    });
 
    return this.toUserResponse(user);
  }
 
  // ─── Login ──────────────────────────────────────────────
 
  async login(data: LoginRequest): Promise<AuthTokens> {
    const { email, password } = data;
 
    // Tìm user
    const user = await prisma.user.findUnique({
      where: { email: email.toLowerCase() },
    });
 
    if (!user) {
      // Dùng cùng message cho email sai và password sai
      // để tránh email enumeration
      throw new AppError('Invalid email or password', 401);
    }
 
    if (!user.isActive) {
      throw new AppError('Account is deactivated', 403);
    }
 
    // Verify password
    const isValid = await bcrypt.compare(password, user.password);
 
    if (!isValid) {
      throw new AppError('Invalid email or password', 401);
    }
 
    // Generate tokens
    return this.generateTokens(user.id, user.email);
  }
 
  // ─── Token Management ──────────────────────────────────
 
  async refreshAccessToken(refreshToken: string): Promise<{ accessToken: string }> {
    // Tìm refresh token trong database
    const storedToken = await prisma.refreshToken.findUnique({
      where: { token: refreshToken },
      include: { user: true },
    });
 
    if (!storedToken) {
      throw new AppError('Invalid refresh token', 401);
    }
 
    // Kiểm tra token hết hạn chưa
    if (storedToken.expiresAt < new Date()) {
      // Dọn dẹp token hết hạn
      await prisma.refreshToken.delete({
        where: { id: storedToken.id },
      });
      throw new AppError('Refresh token has expired', 401);
    }
 
    // Verify JWT signature
    try {
      jwt.verify(refreshToken, env.jwtRefreshSecret);
    } catch {
      await prisma.refreshToken.delete({
        where: { id: storedToken.id },
      });
      throw new AppError('Invalid refresh token', 401);
    }
 
    // Generate access token mới
    const accessToken = this.generateAccessToken(
      storedToken.user.id,
      storedToken.user.email
    );
 
    return { accessToken };
  }
 
  async logout(refreshToken: string): Promise<void> {
    await prisma.refreshToken.deleteMany({
      where: { token: refreshToken },
    });
  }
 
  async logoutAllDevices(userId: string): Promise<void> {
    await prisma.refreshToken.deleteMany({
      where: { userId },
    });
  }
 
  // ─── API Keys ──────────────────────────────────────────
 
  async generateApiKey(userId: string): Promise<{ apiKey: string }> {
    const apiKey = `usk_${crypto.randomBytes(32).toString('hex')}`;
 
    await prisma.user.update({
      where: { id: userId },
      data: { apiKey },
    });
 
    return { apiKey };
  }
 
  async revokeApiKey(userId: string): Promise<void> {
    await prisma.user.update({
      where: { id: userId },
      data: { apiKey: null },
    });
  }
 
  async validateApiKey(apiKey: string): Promise<TokenPayload | null> {
    const user = await prisma.user.findUnique({
      where: { apiKey },
    });
 
    if (!user || !user.isActive) {
      return null;
    }
 
    return { userId: user.id, email: user.email };
  }
 
  // ─── User Profile ──────────────────────────────────────
 
  async getProfile(userId: string): Promise<UserResponse> {
    const user = await prisma.user.findUnique({
      where: { id: userId },
    });
 
    if (!user) {
      throw new AppError('User not found', 404);
    }
 
    return this.toUserResponse(user);
  }
 
  // ─── Private Helpers ───────────────────────────────────
 
  private validatePassword(password: string): void {
    if (password.length < 8) {
      throw new AppError('Password must be at least 8 characters', 400);
    }
 
    if (password.length > 128) {
      throw new AppError('Password must be at most 128 characters', 400);
    }
 
    if (!/[A-Z]/.test(password)) {
      throw new AppError('Password must contain at least one uppercase letter', 400);
    }
 
    if (!/[a-z]/.test(password)) {
      throw new AppError('Password must contain at least one lowercase letter', 400);
    }
 
    if (!/[0-9]/.test(password)) {
      throw new AppError('Password must contain at least one number', 400);
    }
  }
 
  private async generateTokens(userId: string, email: string): Promise<AuthTokens> {
    const accessToken = this.generateAccessToken(userId, email);
    const refreshToken = this.generateRefreshToken(userId, email);
 
    // Tính expiry của refresh token
    const expiresAt = new Date();
    expiresAt.setDate(expiresAt.getDate() + 7); // 7 ngày
 
    // Lưu refresh token vào database
    await prisma.refreshToken.create({
      data: {
        token: refreshToken,
        userId,
        expiresAt,
      },
    });
 
    return { accessToken, refreshToken };
  }
 
  private generateAccessToken(userId: string, email: string): string {
    const payload: TokenPayload = { userId, email };
    return jwt.sign(payload, env.jwtAccessSecret, {
      expiresIn: env.jwtAccessExpiry,
    });
  }
 
  private generateRefreshToken(userId: string, email: string): string {
    const payload: TokenPayload = { userId, email };
    return jwt.sign(payload, env.jwtRefreshSecret, {
      expiresIn: env.jwtRefreshExpiry,
    });
  }
 
  private toUserResponse(user: {
    id: string;
    email: string;
    name: string | null;
    createdAt: Date;
  }): UserResponse {
    return {
      id: user.id,
      email: user.email,
      name: user.name,
      createdAt: user.createdAt,
    };
  }
}

// src/middleware/auth.ts
 
import { Request, Response, NextFunction } from 'express';
import jwt from 'jsonwebtoken';
import { env } from '../config/env';
import { TokenPayload } from '../types/auth';
import { AuthService } from '../services/authService';
 
const authService = new AuthService();
 
// Mở rộng Express Request để include user info
declare global {
  namespace Express {
    interface Request {
      user?: TokenPayload;
    }
  }
}
 
export function verifyToken(
  req: Request,
  res: Response,
  next: NextFunction
): void {
  // Kiểm tra Bearer token
  const authHeader = req.headers.authorization;
 
  // Kiểm tra API key
  const apiKey = req.headers['x-api-key'] as string;
 
  if (!authHeader && !apiKey) {
    res.status(401).json({ error: 'Authentication required' });
    return;
  }
 
  // Thử API key trước
  if (apiKey) {
    authService
      .validateApiKey(apiKey)
      .then((payload) => {
        if (!payload) {
          res.status(401).json({ error: 'Invalid API key' });
          return;
        }
        req.user = payload;
        next();
      })
      .catch(next);
    return;
  }
 
  // Thử Bearer token
  if (authHeader) {
    const parts = authHeader.split(' ');
 
    if (parts.length !== 2 || parts[0] !== 'Bearer') {
      res.status(401).json({
        error: 'Invalid authorization format. Use: Bearer <token>',
      });
      return;
    }
 
    const token = parts[1];
 
    try {
      const payload = jwt.verify(token, env.jwtAccessSecret) as TokenPayload;
      req.user = payload;
      next();
    } catch (err) {
      if (err instanceof jwt.TokenExpiredError) {
        res.status(401).json({
          error: 'Access token has expired',
          code: 'TOKEN_EXPIRED',
        });
        return;
      }
 
      res.status(401).json({ error: 'Invalid access token' });
      return;
    }
  }
}
 
// Optional auth — gắn user nếu có token, nhưng không reject
export function optionalAuth(
  req: Request,
  res: Response,
  next: NextFunction
): void {
  const authHeader = req.headers.authorization;
  const apiKey = req.headers['x-api-key'] as string;
 
  if (!authHeader && !apiKey) {
    next();
    return;
  }
 
  // Delegate cho verifyToken, nhưng bắt 401s và tiếp tục
  verifyToken(req, res, (err) => {
    if (err) {
      // Authentication thất bại, nhưng ok — tiếp tục không có user
      next();
    } else {
      next();
    }
  });
}

// src/middleware/validateAuth.ts
 
import { Request, Response, NextFunction } from 'express';
 
export function validateRegister(
  req: Request,
  res: Response,
  next: NextFunction
): void {
  const { email, password } = req.body;
 
  if (!email || typeof email !== 'string') {
    res.status(400).json({ error: 'Email is required' });
    return;
  }
 
  // Kiểm tra format email cơ bản
  const emailRegex = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
  if (!emailRegex.test(email.trim())) {
    res.status(400).json({ error: 'Invalid email format' });
    return;
  }
 
  if (!password || typeof password !== 'string') {
    res.status(400).json({ error: 'Password is required' });
    return;
  }
 
  // Normalize email
  req.body.email = email.trim().toLowerCase();
  next();
}
 
export function validateLogin(
  req: Request,
  res: Response,
  next: NextFunction
): void {
  const { email, password } = req.body;
 
  if (!email || typeof email !== 'string') {
    res.status(400).json({ error: 'Email is required' });
    return;
  }
 
  if (!password || typeof password !== 'string') {
    res.status(400).json({ error: 'Password is required' });
    return;
  }
 
  req.body.email = email.trim().toLowerCase();
  next();
}
 
export function validateRefreshToken(
  req: Request,
  res: Response,
  next: NextFunction
): void {
  const { refreshToken } = req.body;
 
  if (!refreshToken || typeof refreshToken !== 'string') {
    res.status(400).json({ error: 'Refresh token is required' });
    return;
  }
 
  next();
}

// src/routes/authRoutes.ts
 
import { Router, Request, Response, NextFunction } from 'express';
import { AuthService } from '../services/authService';
import { verifyToken } from '../middleware/auth';
import {
  validateRegister,
  validateLogin,
  validateRefreshToken,
} from '../middleware/validateAuth';
 
const router = Router();
const authService = new AuthService();
 
// POST /api/auth/register
router.post(
  '/register',
  validateRegister,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const user = await authService.register(req.body);
      res.status(201).json({
        message: 'Registration successful',
        user,
      });
    } catch (error) {
      next(error);
    }
  }
);
 
// POST /api/auth/login
router.post(
  '/login',
  validateLogin,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const tokens = await authService.login(req.body);
      res.json({
        message: 'Login successful',
        ...tokens,
      });
    } catch (error) {
      next(error);
    }
  }
);
 
// POST /api/auth/refresh
router.post(
  '/refresh',
  validateRefreshToken,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const result = await authService.refreshAccessToken(req.body.refreshToken);
      res.json(result);
    } catch (error) {
      next(error);
    }
  }
);
 
// POST /api/auth/logout
router.post(
  '/logout',
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const { refreshToken } = req.body;
      if (refreshToken) {
        await authService.logout(refreshToken);
      }
      res.json({ message: 'Logged out successfully' });
    } catch (error) {
      next(error);
    }
  }
);
 
// POST /api/auth/logout-all — revoke tất cả refresh tokens
router.post(
  '/logout-all',
  verifyToken,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      await authService.logoutAllDevices(req.user!.userId);
      res.json({ message: 'Logged out from all devices' });
    } catch (error) {
      next(error);
    }
  }
);
 
// GET /api/auth/profile
router.get(
  '/profile',
  verifyToken,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const profile = await authService.getProfile(req.user!.userId);
      res.json(profile);
    } catch (error) {
      next(error);
    }
  }
);
 
// POST /api/auth/api-key — generate API key mới
router.post(
  '/api-key',
  verifyToken,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const result = await authService.generateApiKey(req.user!.userId);
      res.status(201).json({
        message: 'API key generated. Store it securely — it cannot be retrieved later.',
        ...result,
      });
    } catch (error) {
      next(error);
    }
  }
);
 
// DELETE /api/auth/api-key — revoke API key
router.delete(
  '/api-key',
  verifyToken,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      await authService.revokeApiKey(req.user!.userId);
      res.json({ message: 'API key revoked' });
    } catch (error) {
      next(error);
    }
  }
);
 
export default router;

// src/services/userUrlService.ts
 
import { PrismaClient } from '@prisma/client';
import { env } from '../config/env';
import { AppError } from './urlService';
 
const prisma = new PrismaClient();
 
export interface UserUrl {
  id: string;
  shortCode: string;
  shortUrl: string;
  originalUrl: string;
  clickCount: number;
  customAlias: boolean;
  expiresAt: Date | null;
  createdAt: Date;
}
 
export interface UpdateUrlRequest {
  originalUrl?: string;
  expiresAt?: string | null;
}
 
export interface PaginatedResult<T> {
  data: T[];
  total: number;
  page: number;
  pageSize: number;
  totalPages: number;
}
 
export class UserUrlService {
  // ─── List URL của User ──────────────────────────────────
 
  async listUrls(
    userId: string,
    page: number = 1,
    pageSize: number = 20,
    search?: string
  ): Promise<PaginatedResult<UserUrl>> {
    const skip = (page - 1) * pageSize;
 
    const where: any = { userId };
 
    if (search) {
      where.OR = [
        { shortCode: { contains: search, mode: 'insensitive' } },
        { originalUrl: { contains: search, mode: 'insensitive' } },
      ];
    }
 
    const [urls, total] = await Promise.all([
      prisma.url.findMany({
        where,
        orderBy: { createdAt: 'desc' },
        skip,
        take: pageSize,
      }),
      prisma.url.count({ where }),
    ]);
 
    return {
      data: urls.map(this.toUserUrl),
      total,
      page,
      pageSize,
      totalPages: Math.ceil(total / pageSize),
    };
  }
 
  // ─── Lấy Một URL ────────────────────────────────────────
 
  async getUrl(shortCode: string, userId: string): Promise<UserUrl> {
    const url = await prisma.url.findFirst({
      where: { shortCode, userId },
    });
 
    if (!url) {
      throw new AppError('URL not found or does not belong to you', 404);
    }
 
    return this.toUserUrl(url);
  }
 
  // ─── Update URL ────────────────────────────────────────
 
  async updateUrl(
    shortCode: string,
    userId: string,
    data: UpdateUrlRequest
  ): Promise<UserUrl> {
    // Verify ownership
    const existing = await prisma.url.findFirst({
      where: { shortCode, userId },
    });
 
    if (!existing) {
      throw new AppError('URL not found or does not belong to you', 404);
    }
 
    // Validate URL mới nếu có
    if (data.originalUrl) {
      try {
        const parsed = new URL(data.originalUrl);
        if (!['http:', 'https:'].includes(parsed.protocol)) {
          throw new AppError('Only HTTP and HTTPS URLs are supported', 400);
        }
      } catch (err) {
        if (err instanceof AppError) throw err;
        throw new AppError('Invalid URL format', 400);
      }
    }
 
    // Build update data
    const updateData: any = {};
    if (data.originalUrl) {
      updateData.originalUrl = data.originalUrl;
    }
    if (data.expiresAt !== undefined) {
      updateData.expiresAt = data.expiresAt ? new Date(data.expiresAt) : null;
    }
 
    const updated = await prisma.url.update({
      where: { id: existing.id },
      data: updateData,
    });
 
    return this.toUserUrl(updated);
  }
 
  // ─── Delete URL ────────────────────────────────────────
 
  async deleteUrl(shortCode: string, userId: string): Promise<void> {
    const existing = await prisma.url.findFirst({
      where: { shortCode, userId },
    });
 
    if (!existing) {
      throw new AppError('URL not found or does not belong to you', 404);
    }
 
    await prisma.url.delete({
      where: { id: existing.id },
    });
  }
 
  // ─── URL Stats ─────────────────────────────────────────
 
  async getUrlStats(userId: string): Promise<{
    totalUrls: number;
    totalClicks: number;
    urlsThisMonth: number;
  }> {
    const now = new Date();
    const firstOfMonth = new Date(now.getFullYear(), now.getMonth(), 1);
 
    const [totalUrls, clickAgg, urlsThisMonth] = await Promise.all([
      prisma.url.count({ where: { userId } }),
      prisma.url.aggregate({
        where: { userId },
        _sum: { clickCount: true },
      }),
      prisma.url.count({
        where: {
          userId,
          createdAt: { gte: firstOfMonth },
        },
      }),
    ]);
 
    return {
      totalUrls,
      totalClicks: clickAgg._sum.clickCount || 0,
      urlsThisMonth,
    };
  }
 
  // ─── Private Helpers ───────────────────────────────────
 
  private toUserUrl(url: any): UserUrl {
    return {
      id: url.id,
      shortCode: url.shortCode,
      shortUrl: `${env.baseUrl}/${url.shortCode}`,
      originalUrl: url.originalUrl,
      clickCount: url.clickCount,
      customAlias: url.customAlias,
      expiresAt: url.expiresAt,
      createdAt: url.createdAt,
    };
  }
}

// src/routes/userUrlRoutes.ts
 
import { Router, Request, Response, NextFunction } from 'express';
import { UserUrlService } from '../services/userUrlService';
import { verifyToken } from '../middleware/auth';
 
const router = Router();
const userUrlService = new UserUrlService();
 
// Tất cả routes yêu cầu authentication
router.use(verifyToken);
 
// GET /api/my/urls — list URL của tôi với pagination
router.get(
  '/urls',
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const page = parseInt(req.query.page as string) || 1;
      const pageSize = Math.min(parseInt(req.query.pageSize as string) || 20, 100);
      const search = req.query.search as string | undefined;
 
      const result = await userUrlService.listUrls(
        req.user!.userId,
        page,
        pageSize,
        search
      );
      res.json(result);
    } catch (error) {
      next(error);
    }
  }
);
 
// GET /api/my/urls/:code — lấy một URL của tôi
router.get(
  '/urls/:code',
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const url = await userUrlService.getUrl(
        req.params.code,
        req.user!.userId
      );
      res.json(url);
    } catch (error) {
      next(error);
    }
  }
);
 
// PATCH /api/my/urls/:code — update một URL của tôi
router.patch(
  '/urls/:code',
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const url = await userUrlService.updateUrl(
        req.params.code,
        req.user!.userId,
        req.body
      );
      res.json(url);
    } catch (error) {
      next(error);
    }
  }
);
 
// DELETE /api/my/urls/:code — xóa một URL của tôi
router.delete(
  '/urls/:code',
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      await userUrlService.deleteUrl(req.params.code, req.user!.userId);
      res.status(204).send();
    } catch (error) {
      next(error);
    }
  }
);
 
// GET /api/my/stats — thống kê URL của tôi
router.get(
  '/stats',
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const stats = await userUrlService.getUrlStats(req.user!.userId);
      res.json(stats);
    } catch (error) {
      next(error);
    }
  }
);
 
export default router;

// Trong src/services/urlService.ts — update method shortenUrl
 
async shortenUrl(
  originalUrl: string,
  customAlias?: string,
  userId?: string    // MỚI: optional user ID
): Promise<CreateUrlResponse> {
  let shortCode: string;
 
  if (customAlias) {
    if (!isValidCustomAlias(customAlias)) {
      throw new AppError(
        'Invalid custom alias. Use 3-30 alphanumeric characters, hyphens, or underscores.',
        400
      );
    }
 
    const existingCode = await prisma.url.findUnique({
      where: { shortCode: customAlias },
    });
 
    if (existingCode) {
      throw new AppError('Custom alias is already taken', 409);
    }
 
    shortCode = customAlias;
  } else {
    shortCode = await this.generateUniqueCode();
  }
 
  const record = await prisma.url.create({
    data: {
      shortCode,
      originalUrl,
      userId: userId || null,     // Gắn user nếu authenticated
      customAlias: !!customAlias,
    },
  });
 
  return this.toCreateResponse(record.shortCode, record.originalUrl, record.createdAt);
}

// Trong src/routes/urlRoutes.ts — update POST /shorten handler
 
import { optionalAuth } from '../middleware/auth';
 
router.post(
  '/shorten',
  optionalAuth,          // Dùng optional auth
  validateShortenRequest,
  async (req: Request, res: Response, next: NextFunction) => {
    try {
      const { url, customAlias } = req.body;
      const result = await urlService.shortenUrl(
        url,
        customAlias,
        req.user?.userId    // Pass user ID nếu authenticated
      );
      res.status(201).json(result);
    } catch (error) {
      next(error);
    }
  }
);

// src/app.ts
 
import express from 'express';
import urlRoutes from './routes/urlRoutes';
import redirectRoutes from './routes/redirectRoutes';
import authRoutes from './routes/authRoutes';
import userUrlRoutes from './routes/userUrlRoutes';
import { errorHandler } from './middleware/errorHandler';
 
const app = express();
 
app.use(express.json({ limit: '10kb' }));
 
// Health check
app.get('/health', (_req, res) => {
  res.json({ status: 'ok', timestamp: new Date().toISOString() });
});
 
// API routes
app.use('/api/auth', authRoutes);
app.use('/api/my', userUrlRoutes);
app.use('/api', urlRoutes);
 
// Redirect catch-all (phải ở cuối)
app.use(redirectRoutes);
 
// Error handler
app.use(errorHandler);
 
export default app;

// SAI — lưu plaintext
await prisma.user.create({
  data: { email, password: plaintext },
});
 
// ĐÚNG — hash trước
const hashed = await bcrypt.hash(plaintext, 12);
await prisma.user.create({
  data: { email, password: hashed },
});

// src/middleware/authRateLimit.ts
 
import { Request, Response, NextFunction } from 'express';
 
const loginAttempts = new Map<string, { count: number; resetAt: number }>();
 
const MAX_ATTEMPTS = 5;
const WINDOW_MS = 15 * 60 * 1000; // 15 phút
 
export function loginRateLimit(
  req: Request,
  res: Response,
  next: NextFunction
): void {
  const key = req.ip || 'unknown';
  const now = Date.now();
 
  const record = loginAttempts.get(key);
 
  if (record) {
    if (now > record.resetAt) {
      // Window hết hạn, reset
      loginAttempts.set(key, { count: 1, resetAt: now + WINDOW_MS });
      next();
      return;
    }
 
    if (record.count >= MAX_ATTEMPTS) {
      const retryAfter = Math.ceil((record.resetAt - now) / 1000);
      res.status(429).json({
        error: 'Too many login attempts',
        retryAfter,
      });
      return;
    }
 
    record.count += 1;
  } else {
    loginAttempts.set(key, { count: 1, resetAt: now + WINDOW_MS });
  }
 
  next();
}

import { loginRateLimit } from '../middleware/authRateLimit';
 
router.post('/login', loginRateLimit, validateLogin, async (req, res, next) => {
  // ...
});

// Trong authService.ts
 
async cleanupExpiredTokens(): Promise<number> {
  const result = await prisma.refreshToken.deleteMany({
    where: {
      expiresAt: { lt: new Date() },
    },
  });
 
  return result.count;
}

url-shortener/
├── src/
│   ├── config/
│   │   └── env.ts                # + JWT config
│   ├── middleware/
│   │   ├── auth.ts               # MỚI: JWT + API key verification
│   │   ├── authRateLimit.ts      # MỚI: login rate limiting
│   │   ├── errorHandler.ts
│   │   ├── validateAuth.ts       # MỚI: auth request validation
│   │   └── validateRequest.ts
│   ├── routes/
│   │   ├── authRoutes.ts         # MỚI: register, login, refresh
│   │   ├── redirectRoutes.ts
│   │   ├── urlRoutes.ts          # CẬP NHẬT: optional auth
│   │   └── userUrlRoutes.ts      # MỚI: user-scoped URL CRUD
│   ├── services/
│   │   ├── authService.ts        # MỚI: auth business logic
│   │   ├── urlService.ts         # CẬP NHẬT: userId parameter
│   │   └── userUrlService.ts     # MỚI: user URL management
│   ├── types/
│   │   ├── auth.ts               # MỚI: auth types
│   │   └── url.ts
│   ├── app.ts                    # CẬP NHẬT: route mounts mới
│   └── index.ts
├── prisma/
│   └── schema.prisma             # CẬP NHẬT: User + RefreshToken models
├── .env
└── package.json

curl -X POST http://localhost:3000/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "SecurePass123",
    "name": "Alice"
  }'

{
  "message": "Registration successful",
  "user": {
    "id": "a1b2c3d4-...",
    "email": "[email protected]",
    "name": "Alice",
    "createdAt": "2026-03-21T10:00:00.000Z"
  }
}

curl -X POST http://localhost:3000/api/auth/login \
  -H "Content-Type: application/json" \
  -d '{
    "email": "[email protected]",
    "password": "SecurePass123"
  }'

{
  "message": "Login successful",
  "accessToken": "eyJhbGciOiJIUzI1NiIs...",
  "refreshToken": "eyJhbGciOiJIUzI1NiIs..."
}

export TOKEN="eyJhbGciOiJIUzI1NiIs..."

curl -X POST http://localhost:3000/api/shorten \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"url": "https://github.com/expressjs/express"}'

{
  "shortCode": "aBc1X9z",
  "shortUrl": "http://localhost:3000/aBc1X9z",
  "originalUrl": "https://github.com/expressjs/express",
  "createdAt": "2026-03-21T10:01:00.000Z"
}

curl http://localhost:3000/api/my/urls \
  -H "Authorization: Bearer $TOKEN"

{
  "data": [
    {
      "id": "...",
      "shortCode": "aBc1X9z",
      "shortUrl": "http://localhost:3000/aBc1X9z",
      "originalUrl": "https://github.com/expressjs/express",
      "clickCount": 0,
      "customAlias": false,
      "expiresAt": null,
      "createdAt": "2026-03-21T10:01:00.000Z"
    }
  ],
  "total": 1,
  "page": 1,
  "pageSize": 20,
  "totalPages": 1
}

curl -X PATCH http://localhost:3000/api/my/urls/aBc1X9z \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{"originalUrl": "https://github.com/expressjs/express/releases"}'

{
  "id": "...",
  "shortCode": "aBc1X9z",
  "shortUrl": "http://localhost:3000/aBc1X9z",
  "originalUrl": "https://github.com/expressjs/express/releases",
  "clickCount": 0,
  "customAlias": false,
  "expiresAt": null,
  "createdAt": "2026-03-21T10:01:00.000Z"
}

curl -X DELETE http://localhost:3000/api/my/urls/aBc1X9z \
  -H "Authorization: Bearer $TOKEN" \
  -v

< HTTP/1.1 204 No Content

curl -X POST http://localhost:3000/api/auth/api-key \
  -H "Authorization: Bearer $TOKEN"

{
  "message": "API key generated. Store it securely — it cannot be retrieved later.",
  "apiKey": "usk_a1b2c3d4e5f6..."
}

export API_KEY="usk_a1b2c3d4e5f6..."
 
curl -X POST http://localhost:3000/api/shorten \
  -H "Content-Type: application/json" \
  -H "x-api-key: $API_KEY" \
  -d '{"url": "https://nodejs.org"}'

{
  "shortCode": "xY7mN2q",
  "shortUrl": "http://localhost:3000/xY7mN2q",
  "originalUrl": "https://nodejs.org",
  "createdAt": "2026-03-21T10:05:00.000Z"
}

curl -X POST http://localhost:3000/api/auth/refresh \
  -H "Content-Type: application/json" \
  -d '{"refreshToken": "eyJhbGciOiJIUzI1NiIs..."}'

{
  "accessToken": "eyJhbGciOiJIUzI1NiIs..."
}

curl -X POST http://localhost:3000/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "AnotherPass123"}'

{ "error": "Email is already registered" }

curl -X POST http://localhost:3000/api/auth/register \
  -H "Content-Type: application/json" \
  -d '{"email": "[email protected]", "password": "weak"}'

{ "error": "Password must be at least 8 characters" }

{
  "error": "Access token has expired",
  "code": "TOKEN_EXPIRED"
}

// SAI — secret trong source code
const secret = 'my-super-secret-key';
 
// ĐÚNG — load từ environment
const secret = process.env.JWT_ACCESS_SECRET;

// SAI — ai cũng xóa được bất kỳ URL nào
const url = await prisma.url.findUnique({ where: { shortCode } });
await prisma.url.delete({ where: { id: url.id } });
 
// ĐÚNG — verify ownership
const url = await prisma.url.findFirst({
  where: { shortCode, userId },
});
if (!url) throw new AppError('Not found or not yours', 404);
await prisma.url.delete({ where: { id: url.id } });

// SAI — gửi hết, bao gồm password hash
res.json(user);
 
// ĐÚNG — map sang safe response
res.json({
  id: user.id,
  email: user.email,
  name: user.name,
  createdAt: user.createdAt,
});

# SAI — cùng secret cho cả hai
JWT_SECRET=one-secret-for-everything
 
# ĐÚNG — secrets riêng biệt
JWT_ACCESS_SECRET=access-secret-here
JWT_REFRESH_SECRET=different-refresh-secret