feat(users): enhance and implement new OAuth flow (#451)

* feat(users): enhance security and performance

- Fix user enumeration vulnerabilities with generic error responses
- Add rate limiting to critical endpoints using @nestjs/throttler
- Implement batch getUsersDtoByIds to resolve N+1 query issues
- Replace synchronous bcrypt operations with async versions
- Add secure login with constant-time authentication

* feat(oauth): implement user-friendly OAuth flow with decision page

- Replace automatic user creation with user choice mechanism
- Add OAuth state token system for secure multi-step authentication
- Implement decision page flow allowing users to:
  * Create new account with customizable username/nickname
  * Bind OAuth account to existing user account
- Add new API endpoints:
  * GET /users/auth/oauth/state - retrieve OAuth state information
  * POST /users/oauth/create - create new user from OAuth decision
  * POST /users/oauth/bind - bind OAuth to existing user
- Enhance nickname validation to support Chinese characters
- Improve error handling with better user-facing messages
- Add comprehensive test coverage for new OAuth scenarios

Breaking Changes:
- Replace UsersService.loginWithOAuth() with initiateOAuthFlow()
- OAuth callback now redirects to different pages based on user state:
  * /oauth-success - existing OAuth connection
  * /oauth-verify - email conflict (force binding)
  * /oauth-complete - new decision page for user choice

This improves user experience by eliminating forced automatic registration
and allowing users to maintain control over their account creation process.

* fix: resolve SRP auth test failures and add error filter to users controller

- Update SRP tests to expect generic InvalidLoginCredentialsError
- Add @UseFilters decorator to UsersController
- Fix user profile e2e test user ID

* fix: resolve test failures and database constraint issues

- Update SRP tests to use generic error types
- Add error filter to users controller
- Fix foreign key constraint in user profile queries

* fix(auth): prevent type confusion in token validation

Add explicit string type check before calling indexOf() to prevent
parameter tampering attacks in verify() and decode() methods

* test(users): add unit tests for cookie helper utilities

* test(users): enhance unit tests for OAuth user creation and login flows

Author: HuanCheng65

package.json

@@ -39,6 +39,7 @@
     "@nestjs/mapped-types": "^2.0.6",
     "@nestjs/platform-express": "^10.4.15",
     "@nestjs/serve-static": "^4.0.2",
+    "@nestjs/throttler": "^6.4.0",
     "@prisma/client": "6.4.1",
     "@ruc-cheese/node-srp-rs": "^0.2.2",
     "@simplewebauthn/server": "^13.1.1",
@@ -50,6 +51,7 @@
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "connect-redis": "^8.0.1",
+    "cookie-parser": "^1.4.7",
     "cross-env": "^7.0.3",
     "express": "^4.21.2",
     "express-session": "^1.18.1",
@@ -77,6 +79,7 @@
     "@nestjs/schematics": "^10.1.4",
     "@nestjs/testing": "^10.4.15",
     "@types/bcryptjs": "^3.0.0",
+    "@types/cookie-parser": "^1.4.9",
     "@types/express": "^5.0.0",
     "@types/express-session": "^1.18.1",
     "@types/fluent-ffmpeg": "^2.1.27",

pnpm-lock.yaml

@@ -79,7 +79,7 @@ export class AuthService {
   // Parameters:
   //    token: both the pure jwt token and the one with "Bearer " or "bearer " are supported.
   verify(token: string | undefined): Authorization {
-    if (token == undefined || token == '')
+    if (token == undefined || token == '' || typeof token !== 'string')
       throw new AuthenticationRequiredError();
     if (token.indexOf('Bearer ') == 0) token = token.slice(7);
     else if (token.indexOf('bearer ') == 0) token = token.slice(7);
@@ -225,7 +225,7 @@ export class AuthService {
 
   // Decode a token, WITHOUT verifying it.
   decode(token: string | undefined): TokenPayload {
-    if (token == undefined || token == '')
+    if (token == undefined || token == '' || typeof token !== 'string')
       throw new AuthenticationRequiredError();
     if (token.indexOf('Bearer ') == 0) token = token.slice(7);
     else if (token.indexOf('bearer ') == 0) token = token.slice(7);

src/auth/auth.service.ts

@@ -1,5 +1,6 @@
 import { NestFactory } from '@nestjs/core';
 import { RedisStore } from 'connect-redis';
+import cookieParser from 'cookie-parser';
 import session from 'express-session';
 import Redis from 'ioredis';
 import { AppModule } from './app.module';
@@ -19,6 +20,9 @@ async function bootstrap() {
   };
   app.enableCors(corsOptions);
 
+  // Configure cookie parser middleware
+  app.use(cookieParser(process.env.COOKIE_SECRET));
+
   const redis = new Redis({
     host: process.env.REDIS_HOST ?? 'localhost',
     port: process.env.REDIS_PORT ? parseInt(process.env.REDIS_PORT) : 6379,