feat(auth): support Zalo phoneToken decoding and validation

src/modules/auth/auth.dto.ts

@@ -5,7 +5,16 @@ export interface LoginDto {
 
 export interface ZaloLoginDto {
   accessToken: string;   // Zalo access_token từ getAccessToken() SDK
-  phoneNumber: string;   // SĐT thực từ getPhoneNumber() SDK
+  phoneToken?: string;   // Mã token SĐT từ getPhoneNumber() SDK (giải mã phía server)
+  phoneNumber?: string;  // SĐT thực trực tiếp (cho test/fallback)
+}
+
+export interface ZaloPhoneResponse {
+  data?: {
+    number?: string;
+  };
+  error?: number;
+  message?: string;
 }
 
 export interface ZaloProfileResponse {

src/modules/auth/auth.service.ts

@@ -5,7 +5,7 @@ import { AuthRepository } from './auth.repository';
 import { AppError } from '../../common/errors/app-error';
 import { ERROR_CODE } from '../../common/errors/error-code';
 import { jwtConfig } from '../../config/jwt.config';
-import { LoginDto, ZaloLoginDto, ZaloProfileResponse, LoginResponseDto, AuthTokensDto, MeDto, RegisterDto, UpdateProfileDto, UpdateAvatarDto, UpdatePasswordDto, ForgotPasswordDto, ResetPasswordDto, ResendVerificationDto, SessionQueryDto, SessionsResponseDto } from './auth.dto';
+import { LoginDto, ZaloLoginDto, ZaloProfileResponse, ZaloPhoneResponse, LoginResponseDto, AuthTokensDto, MeDto, RegisterDto, UpdateProfileDto, UpdateAvatarDto, UpdatePasswordDto, ForgotPasswordDto, ResetPasswordDto, ResendVerificationDto, SessionQueryDto, SessionsResponseDto } from './auth.dto';
 import https from 'https';
 import { MailService } from '../../common/services/mail.service';
 import { generateDeviceHash, parseUserAgent } from '../../common/helpers/user-agent.helper';
@@ -446,10 +446,10 @@ export class AuthService {
     dto: ZaloLoginDto,
     metadata?: { userAgent?: string; ipAddress?: string },
   ): Promise<LoginResponseDto> {
-    const { accessToken, phoneNumber } = dto;
+    const { accessToken } = dto;
+    const appSecret = process.env.ZALO_APP_SECRET || '';
 
     // 1. Xác thực access_token với Zalo Graph API
-    const appSecret = process.env.ZALO_APP_SECRET || '';
     const appsecretProof = crypto
       .createHmac('sha256', appSecret)
       .update(accessToken)
@@ -467,8 +467,30 @@ export class AuthService {
     const { id: zaloId, name: zaloName, picture } = zaloProfile;
     const zaloAvatarUrl: string | null = picture?.data?.url || null;
 
-    // 2. Tìm hoặc tạo user theo SĐT
-    let user = await this.repository.findByPhone(phoneNumber);
+    // 2. Lấy và chuẩn hóa số điện thoại (từ phoneToken hoặc phoneNumber)
+    let resolvedPhone = dto.phoneNumber;
+
+    if (dto.phoneToken) {
+      const phoneResponse = await this.fetchZaloPhoneNumber(accessToken, dto.phoneToken, appSecret);
+      if (!phoneResponse || phoneResponse.error !== 0 || !phoneResponse.data?.number) {
+        throw new AppError(
+          phoneResponse?.message || 'Failed to decode phone number from Zalo token',
+          401,
+          ERROR_CODE.INVALID_CREDENTIALS,
+        );
+      }
+      resolvedPhone = phoneResponse.data.number;
+    }
+
+    if (!resolvedPhone) {
+      throw new AppError('Phone number is required', 400, ERROR_CODE.VALIDATION_ERROR);
+    }
+
+    // Chuẩn hóa số điện thoại: +84... hoặc 84... -> 0...
+    resolvedPhone = resolvedPhone.replace(/^\+84/, '0').replace(/^84/, '0');
+
+    // 3. Tìm hoặc tạo user theo SĐT
+    let user = await this.repository.findByPhone(resolvedPhone);
 
     if (user) {
       // User đã tồn tại — liên kết Zalo ID nếu chưa có
@@ -485,7 +507,7 @@ export class AuthService {
       user = await this.repository.createSocialUser({
         fullName: zaloName || undefined,
         avatarUrl: zaloAvatarUrl || undefined,
-        phoneNumber,
+        phoneNumber: resolvedPhone,
         roleId: role.id,
         provider: 'zalo',
         providerUserId: zaloId,
@@ -582,4 +604,36 @@ export class AuthService {
       req.end();
     });
   }
+
+  private fetchZaloPhoneNumber(
+    accessToken: string,
+    phoneToken: string,
+    appSecret: string,
+  ): Promise<ZaloPhoneResponse> {
+    return new Promise((resolve, reject) => {
+      const options = {
+        hostname: 'graph.zalo.me',
+        path: '/v2.0/me/info',
+        method: 'GET',
+        headers: {
+          access_token: accessToken,
+          code: phoneToken,
+          secret_key: appSecret,
+        },
+      };
+      const req = https.request(options, (res) => {
+        let data = '';
+        res.on('data', (chunk) => (data += chunk));
+        res.on('end', () => {
+          try {
+            resolve(JSON.parse(data) as ZaloPhoneResponse);
+          } catch {
+            reject(new Error('Failed to parse Zalo Phone API response'));
+          }
+        });
+      });
+      req.on('error', reject);
+      req.end();
+    });
+  }
 }

src/modules/auth/auth.validation.ts

@@ -10,13 +10,19 @@ export const loginSchema = z.object({
   password: z.string().min(1, 'Password is required'),
 });
 
-export const zaloLoginSchema = z.object({
+export const zaloLoginSchema = z
+  .object({
     accessToken: z.string().min(1, 'Zalo access token is required'),
+    phoneToken: z.string().min(1, 'Phone token must not be empty').optional(),
     phoneNumber: z
       .string()
-    .min(1, 'Phone number is required')
-    .regex(/^(0[3|5|7|8|9])+([0-9]{8})$/, 'Invalid Vietnamese phone number format'),
-});
+      .regex(/^(0[3|5|7|8|9])+([0-9]{8})$/, 'Invalid Vietnamese phone number format')
+      .optional(),
+  })
+  .refine((data) => data.phoneToken || data.phoneNumber, {
+    message: 'Either phoneToken or phoneNumber must be provided',
+    path: ['phoneToken'],
+  });
 
 export const refreshSchema = z.object({
   refreshToken: z.string().optional(),

tests/zalo-auth.test.ts

@@ -75,6 +75,7 @@ describe('Zalo Auth Integration Tests', () => {
 
   describe('Successful Zalo Login Flow', () => {
     let mockFetchZalo: jest.SpyInstance;
+    let mockFetchPhone: jest.SpyInstance;
 
     beforeEach(() => {
       // Mock fetchZaloProfile on AuthService prototype
@@ -89,18 +90,28 @@ describe('Zalo Auth Integration Tests', () => {
           },
         },
       });
+
+      // Mock fetchZaloPhoneNumber on AuthService prototype
+      mockFetchPhone = jest.spyOn(AuthService.prototype as any, 'fetchZaloPhoneNumber').mockResolvedValue({
+        data: {
+          number: '84987654321', // Zalo format with 84
+        },
+        error: 0,
+        message: 'Success',
+      });
     });
 
     afterEach(() => {
       mockFetchZalo.mockRestore();
+      mockFetchPhone.mockRestore();
     });
 
-    it('should create new user and return tokens when phone does not exist yet', async () => {
+    it('should create new user and return tokens when phone does not exist yet (using phoneToken)', async () => {
       const res = await request(app)
         .post('/api/v1/auth/zalo-login')
         .send({
           accessToken: 'valid_mock_token_123',
-          phoneNumber: testPhone,
+          phoneToken: 'valid_phone_token_abc',
         });
 
       expect(res.status).toBe(200);
@@ -129,12 +140,12 @@ describe('Zalo Auth Integration Tests', () => {
       expect(dbUser?.socialAccounts[0].providerUserId).toBe(testZaloId);
     });
 
-    it('should login existing user and return tokens without duplicate creation', async () => {
+    it('should login existing user and return tokens without duplicate creation (using phoneToken)', async () => {
       const res = await request(app)
         .post('/api/v1/auth/zalo-login')
         .send({
           accessToken: 'valid_mock_token_123',
-          phoneNumber: testPhone,
+          phoneToken: 'valid_phone_token_abc',
         });
 
       expect(res.status).toBe(200);