@spfn/auth 0.2.0-beta.81 → 0.2.0-beta.83

package/dist/server.js

@@ -6937,6 +6937,14 @@ var init_schema5 = __esm({
           examples: ["your-kakao-client-secret"]
         })
       },
+      SPFN_AUTH_KAKAO_ADMIN_KEY: {
+        ...envString({
+          description: "Kakao app admin key. Required to verify the User Unlinked webhook (Authorization: KakaoAK header).",
+          required: false,
+          sensitive: true,
+          examples: ["your-kakao-admin-key"]
+        })
+      },
       SPFN_AUTH_KAKAO_SCOPES: {
         ...envString({
           description: "Comma-separated Kakao consent scopes. Defaults to account_email.",
@@ -8398,6 +8406,16 @@ var authDeletionCompletedEvent = defineEvent(
     purgeStrategy: Type.Union([Type.Literal("anonymize"), Type.Literal("hard-delete")])
   })
 );
+var oauthUnlinkedEvent = defineEvent(
+  "auth.oauth.unlinked",
+  Type.Object({
+    userId: Type.String(),
+    provider: AuthProviderSchema,
+    providerUserId: Type.String(),
+    /** provider가 전달한 해제 경로 (kakao referrer_type 등) */
+    reason: Type.Optional(Type.String())
+  })
+);
 
 // src/server/services/account-deletion.service.ts
 var POSTGRES_UNIQUE_VIOLATION = "23505";
@@ -9521,6 +9539,14 @@ async function verifyOAuthState(encryptedState) {
 }
 
 // src/server/lib/oauth/provider.ts
+var UnlinkNotifyRejection = class extends Error {
+  status;
+  constructor(status, message) {
+    super(message);
+    this.name = "UnlinkNotifyRejection";
+    this.status = status;
+  }
+};
 var registry2 = /* @__PURE__ */ new Map();
 function registerOAuthProvider(provider) {
   registry2.set(provider.id, provider);
@@ -9835,6 +9861,7 @@ registerOAuthProvider(githubProvider);
 // src/server/lib/oauth/kakao-provider.ts
 init_config();
 import { ValidationError as ValidationError7 } from "@spfn/core/errors";
+import { timingSafeEqual } from "crypto";
 var KAKAO_AUTH_URL = "https://kauth.kakao.com/oauth/authorize";
 var KAKAO_TOKEN_URL = "https://kauth.kakao.com/oauth/token";
 var KAKAO_USERINFO_URL = "https://kapi.kakao.com/v2/user/me";
@@ -9938,6 +9965,32 @@ var kakaoProvider = {
       params.set("client_secret", config2.clientSecret);
     }
     return requestKakaoTokens(params);
+  },
+  /**
+   * 카카오 연결 해제 웹훅(User Unlinked) 검증
+   *
+   * 카카오는 `Authorization: KakaoAK ${대표 어드민 키}` 헤더로 요청하므로
+   * 어드민 키 일치가 곧 발신자 검증이다. 웹훅 규격상 GET/POST 모두 가능하며
+   * 본문 필드는 app_id · user_id · referrer_type.
+   */
+  async verifyUnlinkNotification(request) {
+    const adminKey = env3.SPFN_AUTH_KAKAO_ADMIN_KEY;
+    if (!adminKey) {
+      throw new UnlinkNotifyRejection(401, "SPFN_AUTH_KAKAO_ADMIN_KEY is not configured");
+    }
+    const expected = Buffer.from(`KakaoAK ${adminKey}`);
+    const actual = Buffer.from(request.authorization ?? "");
+    if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+      throw new UnlinkNotifyRejection(401, "Kakao admin key mismatch");
+    }
+    const userId = request.fields.user_id;
+    if (!userId) {
+      throw new UnlinkNotifyRejection(400, "Kakao unlink webhook is missing user_id");
+    }
+    return {
+      providerUserId: userId,
+      reason: request.fields.referrer_type
+    };
   }
 };
 registerOAuthProvider(kakaoProvider);
@@ -9945,6 +9998,7 @@ registerOAuthProvider(kakaoProvider);
 // src/server/lib/oauth/naver-provider.ts
 init_config();
 import { ValidationError as ValidationError8 } from "@spfn/core/errors";
+import { createDecipheriv, createHash as createHash3, createHmac, timingSafeEqual as timingSafeEqual2 } from "crypto";
 var NAVER_AUTH_URL = "https://nid.naver.com/oauth2.0/authorize";
 var NAVER_TOKEN_URL = "https://nid.naver.com/oauth2.0/token";
 var NAVER_USERINFO_URL = "https://openapi.naver.com/v1/nid/me";
@@ -9983,6 +10037,25 @@ async function requestNaverTokens(params) {
     expiresIn
   };
 }
+function deriveNaverUnlinkKey(clientSecret) {
+  return createHash3("md5").update(clientSecret).digest().subarray(0, 16);
+}
+function decodeBase64Url(value) {
+  return Buffer.from(value.replace(/-/g, "+").replace(/_/g, "/"), "base64");
+}
+function decryptNaverUniqueId(encryptUniqueId, key) {
+  try {
+    const payload = decodeBase64Url(encryptUniqueId);
+    const decipher = createDecipheriv("aes-128-cbc", key, payload.subarray(0, 16));
+    const uniqueId = Buffer.concat([
+      decipher.update(payload.subarray(16)),
+      decipher.final()
+    ]).toString("utf8");
+    return uniqueId || null;
+  } catch {
+    return null;
+  }
+}
 var naverProvider = {
   id: "naver",
   isEnabled() {
@@ -10038,6 +10111,46 @@ var naverProvider = {
       client_secret: config2.clientSecret,
       refresh_token: refreshToken
     }));
+  },
+  // 네이버 연결 끊기 알림 규격은 성공 응답으로 204 No Content를 요구한다.
+  unlinkNotifyAckStatus: 204,
+  /**
+   * 네이버 연결 끊기 알림 검증
+   *
+   * 파라미터: clientId · encryptUniqueId · timestamp · signature.
+   * signature = base64url( HMAC-SHA256( "clientId=..&encryptUniqueId=..&timestamp=..", key ) ),
+   * encryptUniqueId = base64url( iv(16) + AES-128-CBC-PKCS5(uniqueId, key) ),
+   * key = md5(CLIENT_SECRET)[0..16].
+   *
+   * 복호화된 uniqueId는 프로필 API(/v1/nid/me)의 id와 동일한 이용자 고유 식별자다.
+   * 네이버는 실패 요청을 재시도하지 않으므로 재전송(replay) 방어는 검증 통과 후
+   * 삭제가 멱등이라는 점에 의존한다.
+   */
+  async verifyUnlinkNotification(request) {
+    const clientId = env3.SPFN_AUTH_NAVER_CLIENT_ID;
+    const clientSecret = env3.SPFN_AUTH_NAVER_CLIENT_SECRET;
+    if (!clientId || !clientSecret) {
+      throw new UnlinkNotifyRejection(403, "Naver OAuth is not configured");
+    }
+    const { clientId: requestClientId, encryptUniqueId, timestamp: timestamp2, signature } = request.fields;
+    if (!requestClientId || !encryptUniqueId || !timestamp2 || !signature) {
+      throw new UnlinkNotifyRejection(400, "Naver unlink notification is missing required parameters");
+    }
+    if (requestClientId !== clientId) {
+      throw new UnlinkNotifyRejection(403, "Naver unlink notification clientId mismatch");
+    }
+    const key = deriveNaverUnlinkKey(clientSecret);
+    const baseString = `clientId=${requestClientId}&encryptUniqueId=${encryptUniqueId}&timestamp=${timestamp2}`;
+    const expected = createHmac("sha256", key).update(baseString).digest();
+    const actual = decodeBase64Url(signature);
+    if (expected.length !== actual.length || !timingSafeEqual2(expected, actual)) {
+      throw new UnlinkNotifyRejection(403, "Naver unlink notification signature mismatch");
+    }
+    const uniqueId = decryptNaverUniqueId(encryptUniqueId, key);
+    if (!uniqueId) {
+      throw new UnlinkNotifyRejection(400, "Naver encryptUniqueId cannot be decrypted");
+    }
+    return { providerUserId: uniqueId, reason: "NAVER_UNLINK" };
   }
 };
 registerOAuthProvider(naverProvider);
@@ -10265,6 +10378,25 @@ async function getGoogleAccessToken(userId) {
   });
   return tokens.access_token;
 }
+async function oauthUnlinkNotifyService(provider, notification) {
+  const oauthProvider = requireEnabledProvider(provider);
+  const ackStatus = oauthProvider.unlinkNotifyAckStatus ?? 200;
+  const account = await socialAccountsRepository.findByProviderAndProviderId(
+    provider,
+    notification.providerUserId
+  );
+  if (!account) {
+    return { ackStatus, handled: false };
+  }
+  await socialAccountsRepository.deleteById(account.id);
+  await oauthUnlinkedEvent.emit({
+    userId: String(account.userId),
+    provider,
+    providerUserId: notification.providerUserId,
+    reason: notification.reason
+  });
+  return { ackStatus, handled: true };
+}
 
 // src/server/services/oauth-native.service.ts
 init_repositories();
@@ -11558,6 +11690,56 @@ var oauthNative = route4.post("/_auth/oauth/:provider/native").input({
   const { params, body } = await c.data();
   return await oauthNativeService({ provider: params.provider, ...body });
 });
+async function collectUnlinkNotifyFields(raw) {
+  const fields = { ...raw.req.query() };
+  if (raw.req.method === "GET") {
+    return fields;
+  }
+  const contentType = raw.req.header("content-type") ?? "";
+  if (contentType.includes("application/json")) {
+    const body2 = await raw.req.json().catch(() => null);
+    for (const [key, value] of Object.entries(body2 ?? {})) {
+      if (typeof value === "string" || typeof value === "number") {
+        fields[key] = String(value);
+      }
+    }
+    return fields;
+  }
+  const body = await raw.req.parseBody().catch(() => ({}));
+  for (const [key, value] of Object.entries(body)) {
+    if (typeof value === "string") {
+      fields[key] = value;
+    }
+  }
+  return fields;
+}
+async function processUnlinkNotify(provider, raw) {
+  const oauthProvider = getOAuthProvider(provider);
+  if (!oauthProvider?.isEnabled() || !oauthProvider.verifyUnlinkNotification) {
+    return 404;
+  }
+  const request = {
+    authorization: raw.req.header("authorization") ?? null,
+    fields: await collectUnlinkNotifyFields(raw)
+  };
+  try {
+    const notification = await oauthProvider.verifyUnlinkNotification(request);
+    const result = await oauthUnlinkNotifyService(provider, notification);
+    return result.ackStatus;
+  } catch (error) {
+    return error instanceof UnlinkNotifyRejection ? error.status : 400;
+  }
+}
+var oauthUnlinkNotify = route4.post("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy4("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  const { params } = await c.data();
+  const status = await processUnlinkNotify(params.provider, c.raw);
+  return status === 204 ? c.noContent() : c.json({}, status);
+});
+var oauthUnlinkNotifyGet = route4.get("/_auth/oauth/:provider/unlink-notify").input({ params: providerParams }).use([rateLimitPolicy4("oauth-unlink-notify", { limit: 300, windowMs: 6e4 })]).skip(["auth"]).handler(async (c) => {
+  const { params } = await c.data();
+  const status = await processUnlinkNotify(params.provider, c.raw);
+  return status === 204 ? c.noContent() : c.json({}, status);
+});
 var oauthRouter = defineRouter4({
   oauthGoogleStart,
   oauthGoogleCallback,
@@ -11568,7 +11750,9 @@ var oauthRouter = defineRouter4({
   oauthProviderStart,
   oauthProviderCallback,
   getProviderOAuthUrl,
-  oauthNative
+  oauthNative,
+  oauthUnlinkNotify,
+  oauthUnlinkNotifyGet
 });
 
 // src/server/routes/admin/index.ts
@@ -11729,6 +11913,8 @@ var mainAuthRouter = defineRouter6({
   oauthProviderCallback,
   getProviderOAuthUrl,
   oauthNative,
+  oauthUnlinkNotify,
+  oauthUnlinkNotifyGet,
   // Invitation routes
   getInvitation,
   acceptInvitation: acceptInvitation2,
@@ -12130,6 +12316,7 @@ export {
   SocialAccountsRepository,
   TargetTypeSchema,
   USER_STATUSES,
+  UnlinkNotifyRejection,
   UserPermissionsRepository,
   UserProfilesRepository,
   UsersRepository,
@@ -12243,6 +12430,8 @@ export {
   oauthCallbackService,
   oauthNativeService,
   oauthStartService,
+  oauthUnlinkNotifyService,
+  oauthUnlinkedEvent,
   oneTimeTokenAuth,
   optionalAuth,
   parseDuration,