npm install express redis ioredis uuid crypto
npm install -D typescript @types/express @types/node

import express, { Request, Response } from "express";
import { createClient } from "redis";
import crypto from "crypto";

const app = express();
app.use(express.json());

// Redis client
const redis = createClient({ url: "redis://localhost:6379" });
redis.connect();

// Sinh opaque token (32 bytes → 64 ký tự hex)
function generateToken(): string {
  return crypto.randomBytes(32).toString("hex");
  // Kết quả: "a8f3k2m9x7q1b5c2d4e6f8g0..."
}

app.post("/login", async (req: Request, res: Response) => {
  const { username, password } = req.body;

  // 1. Verify credentials (mock — thực tế query DB thật)
  if (username !== "jerry" || password !== "password123") {
    return res.status(401).json({ error: "Sai username/password" });
  }

  // 2. Lấy user info từ DB
  const user = { userId: "123", username: "jerry", role: "admin" };

  // 3. Sinh opaque token
  const token = generateToken();

  // 4. Lưu vào Redis — key là token, value là user info
  // TTL: 24h (token tự expire)
  await redis.set(
    `session:${token}`,
    JSON.stringify(user),
    { EX: 24 * 60 * 60 } // 86400 seconds
  );

  // 5. Trả token cho client
  res.json({
    accessToken: token,
    tokenType: "Bearer",
    expiresIn: 86400,
  });
});

import { Request, Response, NextFunction } from "express";
import { createClient } from "redis";

const redis = createClient({ url: "redis://localhost:6379" });
redis.connect();

// Extend Express Request để có req.user
declare global {
  namespace Express {
    interface Request {
      user?: { userId: string; username: string; role: string };
    }
  }
}

export async function authMiddleware(
  req: Request,
  res: Response,
  next: NextFunction
) {
  // 1. Lấy token từ header
  const authHeader = req.headers["authorization"];
  const token = authHeader?.startsWith("Bearer ")
    ? authHeader.slice(7)
    : null;

  if (!token) {
    return res.status(401).json({ error: "Không có token" });
  }

  // 2. Query Redis bằng token
  const userData = await redis.get(`session:${token}`);

  if (!userData) {
    return res.status(401).json({ error: "Token không hợp lệ hoặc đã hết hạn" });
  }

  // 3. Parse user info → gắn vào req.user
  req.user = JSON.parse(userData);

  // 4. Cho qua
  next();
}

import { authMiddleware } from "./authMiddleware";

app.get("/profile", authMiddleware, (req: Request, res: Response) => {
  // req.user đã có từ middleware
  res.json({
    message: "Đây là data protected",
    user: req.user,
  });
});

app.get("/admin", authMiddleware, (req: Request, res: Response) => {
  if (req.user?.role !== "admin") {
    return res.status(403).json({ error: "Không có quyền" });
  }
  res.json({ message: "Welcome admin!" });
});

app.post("/logout", authMiddleware, async (req: Request, res: Response) => {
  const authHeader = req.headers["authorization"];
  const token = authHeader?.slice(7);

  // Xóa token khỏi Redis → revoke ngay lập tức
  if (token) {
    await redis.del(`session:${token}`);
  }

  res.json({ message: "Đăng xuất thành công" });
});

# 1. Login
curl -X POST http://localhost:3000/login \
  -H "Content-Type: application/json" \
  -d '{"username":"jerry","password":"password123"}'

# Response:
{
  "accessToken": "a8f3k2…0...",
  "tokenType": "Bearer",
  "expiresIn": 86400
}

# 2. Gọi API protected
curl http://localhost:3000/profile \
  -H "Authorization: Bearer a8f3k2…0..."

# Response:
{
  "message": "Đây là data protected",
  "user": { "userId": "123", "username": "jerry", "role": "admin" }
}

# 3. Logout (revoke token)
curl -X POST http://localhost:3000/logout \
  -H "Authorization: Bearer a8f3k2…0..."

# 4. Gọi lại với token cũ → 401
curl http://localhost:3000/profile \
  -H "Authorization: Bearer a8f3k2…0..."
# → {"error": "Token không hợp lệ hoặc đã hết hạn"}

// JWT middleware — KHÔNG cần query DB
function jwtMiddleware(req, res, next) {
  const token = req.headers.authorization?.slice(7);
  const user = jwt.verify(token, SECRET_KEY);  // ✅ verify bằng CPU
  req.user = user;
  next();
}

// Opaque Token middleware — PHẢI query DB
async function opaqueMiddleware(req, res, next) {
  const token = req.headers.authorization?.slice(7);
  const userData = await redis.get(`session:${token}`);  // ❌ phải I/O
  if (!userData) return res.status(401).send("Invalid");
  req.user = JSON.parse(userData);
  next();
}