create-entity-app-server 0.0.3 → 0.1.13

package/src/system/scheduler/distributed-lock.ts

@@ -1,141 +0,0 @@
-/**
- * 분산 락 — 멀티인스턴스 중복 실행 방지
- *
- * Go `internal/privacy/service.go` acquireLock/releaseLock 포팅.
- *
- * `privacy_cron_lock` 엔티티의 unique constraint를 활용한 슬롯 기반 락.
- * 엔티티가 없으면 단일 인스턴스로 간주하고 항상 true 반환.
- *
- * 슬롯 계산:
- *   slot = `${jobName}:${Math.floor(now / ttlSec)}`
- *   → 동일 interval 내 모든 인스턴스가 같은 slot 값을 사용
- *   → Insert 시 unique constraint 위반 = 다른 인스턴스가 이미 처리 중
- */
-
-import { entityServer, logger } from "@gateway/api";
-import { hostname } from "node:os";
-
-/**
- * 분산 락을 획득한다.
- *
- * @param jobName  작업 식별자 (예: "privacy:password_expiry")
- * @param ttlSec   락 유효 시간(초) — 같은 값으로 release 호출해야 함
- * @returns 락 획득 성공 여부
- */
-export async function acquireLock(
-    jobName: string,
-    ttlSec: number,
-): Promise<boolean> {
-    const now = Math.floor(Date.now() / 1000);
-    const slotNum = Math.floor(now / ttlSec);
-    const slot = `${jobName}:${slotNum}`;
-    const expiresAt = new Date((now + ttlSec) * 1000)
-        .toISOString()
-        .replace("T", " ")
-        .slice(0, 19);
-    const lockedBy = `${hostname()}:${process.pid}`;
-
-    // 1단계: 즉시 Insert 시도 — unique constraint로 동시 실행 방지
-    try {
-        await entityServer.submit("privacy_cron_lock", {
-            job_name: slot,
-            locked_by: lockedBy,
-            locked_time: new Date(now * 1000)
-                .toISOString()
-                .replace("T", " ")
-                .slice(0, 19),
-            expires_time: expiresAt,
-        });
-        return true;
-    } catch (insertErr) {
-        // unique constraint 위반 또는 privacy_cron_lock 엔티티 미설정
-        try {
-            // 2단계: 기존 락 확인 (stale 여부 체크)
-            const existing = await entityServer.find<Record<string, unknown>>(
-                "privacy_cron_lock",
-                { job_name: slot },
-            );
-            if (!existing?.data) {
-                // 찾을 수 없음 — 다른 인스턴스가 이미 처리 완료
-                logger.info(
-                    { jobName },
-                    "Distributed lock: contention, skipping",
-                );
-                return false;
-            }
-
-            const expStr = String(existing.data.expires_time ?? "");
-            const nowStr = new Date(now * 1000)
-                .toISOString()
-                .replace("T", " ")
-                .slice(0, 19);
-
-            if (expStr && expStr < nowStr) {
-                // 만료된 stale 락 → 삭제 후 재시도
-                const seq = Number(existing.data.seq);
-                if (seq > 0) {
-                    await entityServer.delete("privacy_cron_lock", seq);
-                }
-                // 삭제 후 한 번 더 Insert 시도
-                try {
-                    await entityServer.submit("privacy_cron_lock", {
-                        job_name: slot,
-                        locked_by: lockedBy,
-                        locked_time: new Date(now * 1000)
-                            .toISOString()
-                            .replace("T", " ")
-                            .slice(0, 19),
-                        expires_time: expiresAt,
-                    });
-                    return true;
-                } catch {
-                    logger.info(
-                        { jobName },
-                        "Distributed lock: contention after stale cleanup",
-                    );
-                    return false;
-                }
-            }
-
-            // 유효한 락 — 다른 인스턴스가 실행 중
-            logger.info(
-                { jobName },
-                "Distributed lock: already held by another instance",
-            );
-            return false;
-        } catch {
-            // privacy_cron_lock 엔티티 미설정 → 단일 인스턴스 모드
-            return true;
-        }
-    }
-}
-
-/**
- * 분산 락을 해제한다.
- *
- * @param jobName  acquireLock과 동일한 작업 식별자
- * @param ttlSec   acquireLock과 동일한 TTL
- */
-export async function releaseLock(
-    jobName: string,
-    ttlSec: number,
-): Promise<void> {
-    const now = Math.floor(Date.now() / 1000);
-    const slotNum = Math.floor(now / ttlSec);
-    const slot = `${jobName}:${slotNum}`;
-
-    try {
-        const existing = await entityServer.find<Record<string, unknown>>(
-            "privacy_cron_lock",
-            { job_name: slot },
-        );
-        if (existing?.data) {
-            const seq = Number(existing.data.seq);
-            if (seq > 0) {
-                await entityServer.delete("privacy_cron_lock", seq);
-            }
-        }
-    } catch {
-        // ignore — 엔티티 미설정 또는 이미 삭제됨
-    }
-}

package/src/system/scheduler/schedule-loader.ts

@@ -1,105 +0,0 @@
-/**
- * Schedule auto-loader
- *
- * Scans app/schedules/{name}/index.ts and calls
- * start() / stop() interface methods.
- *
- * - onReady: start() for each scheduler
- * - onClose: stop() for each scheduler
- */
-
-import type { FastifyInstance } from "fastify";
-import { readdirSync, existsSync } from "node:fs";
-import { join } from "node:path";
-import { pathToFileURL } from "node:url";
-import { logger } from "../config/env.ts";
-import { resolveAppRoot } from "../utils/app-path.ts";
-import { resolveModulePath } from "../config/module-path.ts";
-
-interface ScheduleModule {
-    start: () => void | Promise<void>;
-    stop: () => void | Promise<void>;
-}
-
-/**
- * Scans app/schedules/ subdirectories,
- * dynamic-imports index.ts (or index.js),
- * and hooks start/stop into Fastify lifecycle.
- */
-export async function loadSchedules(app: FastifyInstance): Promise<number> {
-    const schedulesDir = join(resolveAppRoot(import.meta.url), "schedules");
-    if (!existsSync(schedulesDir)) return 0;
-
-    const dirs = readdirSync(schedulesDir, { withFileTypes: true }).filter(
-        (d) => d.isDirectory(),
-    );
-
-    const modules: ScheduleModule[] = [];
-    const total = dirs.length;
-    let loaded = 0;
-    const isTTY = process.stdout.isTTY;
-
-    for (const dir of dirs) {
-        const modulePath = resolveModulePath(
-            join(schedulesDir, dir.name),
-            "index",
-        );
-        if (!modulePath) continue;
-
-        loaded++;
-        if (isTTY) {
-            process.stdout.write(
-                `\r  Loading schedules [${loaded}/${total}]...`.padEnd(72),
-            );
-        }
-
-        try {
-            const mod = (await import(
-                pathToFileURL(modulePath).href
-            )) as ScheduleModule;
-            if (typeof mod.start === "function") {
-                modules.push(mod);
-            } else {
-                logger.warn(
-                    "Schedule " + dir.name + "/index.ts must export start()",
-                );
-            }
-        } catch (err) {
-            logger.error({ err }, "Failed to load schedule: " + dir.name);
-        }
-    }
-
-    if (isTTY && total > 0) {
-        process.stdout.write(`\r${" ".repeat(72)}\r`);
-    }
-
-    if (modules.length === 0) return 0;
-
-    // onReady - start all schedulers (병렬)
-    app.addHook("onReady", async () => {
-        await Promise.allSettled(
-            modules.map(async (mod) => {
-                try {
-                    await mod.start();
-                } catch (err) {
-                    logger.error({ err }, "Schedule start failed");
-                }
-            }),
-        );
-    });
-
-    // onClose - stop all schedulers (병렬)
-    app.addHook("onClose", async () => {
-        await Promise.allSettled(
-            modules.map(async (mod) => {
-                try {
-                    await mod.stop();
-                } catch (err) {
-                    logger.error({ err }, "Schedule stop failed");
-                }
-            }),
-        );
-    });
-
-    return modules.length;
-}

package/src/system/security/anonymous-device-id.ts

@@ -1,41 +0,0 @@
-/**
- * 익명 디바이스 ID 쿠키 관리
- *
- * 요청에서 디바이스 ID를 읽거나, 없으면 새로 생성하여 쿠키로 설정합니다.
- */
-
-import { randomUUID } from "crypto";
-import type { FastifyReply, FastifyRequest } from "fastify";
-import type { PacketEncryptConfig } from "../config/packet-encrypt.ts";
-import {
-    parseCookies,
-    serializeCookie,
-    appendSetCookie,
-} from "../http/cookie.ts";
-
-export function readAnonymousDeviceId(
-    req: FastifyRequest,
-    cfg: PacketEncryptConfig,
-): string | null {
-    if (!cfg.anonymousEnabled) return null;
-    const cookies = parseCookies(req.headers.cookie);
-    const deviceId = cookies[cfg.deviceCookieName];
-    return deviceId ? deviceId.trim() : null;
-}
-
-export function ensureAnonymousDeviceId(
-    req: FastifyRequest,
-    reply: FastifyReply,
-    cfg: PacketEncryptConfig,
-): string | null {
-    if (!cfg.anonymousEnabled) return null;
-    const current = readAnonymousDeviceId(req, cfg);
-    if (current) return current;
-
-    const created = randomUUID();
-    appendSetCookie(
-        reply,
-        serializeCookie(cfg.deviceCookieName, created, cfg.deviceCookieOptions),
-    );
-    return created;
-}

package/src/system/security/anonymous-device.ts

@@ -1,98 +0,0 @@
-import type { FastifyReply, FastifyRequest } from "fastify";
-import { entityServer, logger } from "@gateway/api";
-import { ensureAnonymousDeviceId } from "./anonymous-device-id.ts";
-import {
-    loadPacketEncryptConfig,
-    type PacketEncryptConfig,
-} from "../config/packet-encrypt.ts";
-import { postEntityAdmin } from "../entity-server/client.ts";
-import { formatSqlDateTime } from "../utils/format.ts";
-import { parseUserAgent } from "../utils/user-agent.ts";
-
-function buildAnonDevicePayload(req: FastifyRequest, deviceId: string) {
-    const now = formatSqlDateTime();
-    const userAgent = parseUserAgent(req.headers["user-agent"]);
-    const payload: Record<string, unknown> = {
-        id: deviceId,
-        last_seen_time: now,
-        last_ip_addr: req.ip,
-    };
-
-    if (userAgent.raw) {
-        payload.user_agent = userAgent.raw;
-        if (userAgent.platform) payload.platform = userAgent.platform;
-        if (userAgent.deviceType) payload.device_type = userAgent.deviceType;
-        if (userAgent.browser) payload.browser = userAgent.browser;
-        if (userAgent.browserVersion) {
-            payload.browser_version = userAgent.browserVersion;
-        }
-    }
-
-    return { now, payload };
-}
-
-async function ensureAnonDeviceSchema(): Promise<void> {
-    await postEntityAdmin("/anon_device/sync-schema");
-}
-
-async function upsertAnonymousDevice(
-    deviceId: string,
-    payload: Record<string, unknown>,
-    now: string,
-): Promise<void> {
-    const existing = await entityServer.list("anon_device", {
-        conditions: { id: deviceId },
-        page: 1,
-        limit: 1,
-    });
-
-    const item = ((existing.data as any)?.items ?? [])[0] as
-        | Record<string, unknown>
-        | undefined;
-
-    if (item?.seq) {
-        await entityServer.submit("anon_device", {
-            seq: Number(item.seq),
-            ...payload,
-        });
-        return;
-    }
-
-    await entityServer.submit("anon_device", {
-        ...payload,
-        first_seen_time: now,
-        calc_count: 0,
-    });
-}
-
-export async function ensureAndSyncAnonymousDevice(
-    req: FastifyRequest,
-    reply: FastifyReply,
-    cfg: PacketEncryptConfig = loadPacketEncryptConfig(),
-): Promise<string | null> {
-    const deviceId = ensureAnonymousDeviceId(req, reply, cfg);
-    if (!deviceId) return null;
-
-    const { now, payload } = buildAnonDevicePayload(req, deviceId);
-
-    try {
-        await upsertAnonymousDevice(deviceId, payload, now);
-    } catch (err) {
-        try {
-            await ensureAnonDeviceSchema();
-            await upsertAnonymousDevice(deviceId, payload, now);
-        } catch (retryErr) {
-            logger.warn(
-                {
-                    err: retryErr,
-                    cause: err,
-                    entity: "anon_device",
-                    deviceId,
-                },
-                "Anonymous device sync failed",
-            );
-        }
-    }
-
-    return deviceId;
-}

package/src/system/security/anonymous-packet-token.ts

@@ -1,23 +0,0 @@
-/**
- * 익명 패킷 토큰 파생
- *
- * 디바이스 ID와 HMAC secret으로 패킷 암호화용 토큰을 생성합니다.
- */
-
-import { createHmac } from "crypto";
-import { env } from "../config/env.ts";
-import type { PacketEncryptConfig } from "../config/packet-encrypt.ts";
-
-export function deriveAnonymousPacketToken(
-    deviceId: string,
-    cfgOrInfoLabel: PacketEncryptConfig | string,
-): string {
-    const infoLabel =
-        typeof cfgOrInfoLabel === "string"
-            ? cfgOrInfoLabel
-            : cfgOrInfoLabel.infoLabel;
-    const digest = createHmac("sha256", env.ENTITY_HMAC_SECRET)
-        .update(`${infoLabel}:anonymous:${deviceId}`)
-        .digest("base64url");
-    return `anon.v1.${digest}`;
-}

package/src/system/security/packet-bootstrap.ts

@@ -1,16 +0,0 @@
-/**
- * packet-bootstrap — 호환 재내보내기
- *
- * 기존 import를 유지하기 위한 barrel. 실제 구현은 각 모듈로 분리됨.
- */
-
-export {
-    loadPacketEncryptConfig,
-    type PacketEncryptConfig,
-} from "../config/packet-encrypt.ts";
-export { parseCookies, serializeCookie } from "../http/cookie.ts";
-export {
-    readAnonymousDeviceId,
-    ensureAnonymousDeviceId,
-} from "./anonymous-device-id.ts";
-export { deriveAnonymousPacketToken } from "./anonymous-packet-token.ts";

package/src/system/security/password-policy.ts

@@ -1,191 +0,0 @@
-/**
- * 비밀번호 정책 검증
- *
- * configs/security.json 의 password_policy 섹션을 기반으로
- * 회원가입·비밀번호 변경 시 복잡도/금지패턴을 검증한다.
- *
- * Go internal/privacy/service.go ValidatePasswordPolicy +
- *    internal/security/password.go ValidateForbiddenPatterns 포팅
- */
-
-import { z } from "zod";
-import { loadSecurityJson } from "../config/security-loader.ts";
-
-// ─── 스키마 ─────────────────────────────────────────────────────────────────
-
-const forbiddenPatternsSchema = z
-    .object({
-        sequential_digits: z.boolean().default(true),
-        repeated_chars: z.boolean().default(true),
-        keyboard_patterns: z.boolean().default(false),
-        sequential_length: z.coerce.number().int().min(2).default(4),
-    })
-    .default({});
-
-const piiCheckSchema = z
-    .object({
-        enabled: z.boolean().default(false),
-        entity: z.string().default("user"),
-        fields: z.array(z.string()).default([]),
-    })
-    .default({});
-
-const passwordPolicySchema = z.object({
-    enabled: z.boolean().default(false),
-    min_length: z.coerce.number().int().default(8),
-    max_length: z.coerce.number().int().default(128),
-    require_mixed_case: z.boolean().default(false),
-    require_number: z.boolean().default(false),
-    require_special: z.boolean().default(false),
-    history_count: z.coerce.number().int().default(5),
-    forbidden_patterns: forbiddenPatternsSchema,
-    pii_check: piiCheckSchema,
-});
-
-export type PasswordPolicy = z.infer<typeof passwordPolicySchema>;
-
-// ─── 로더 ───────────────────────────────────────────────────────────────────
-
-let _policy: PasswordPolicy | undefined;
-
-/** security.json 에서 password_policy 를 로드한다 (캐시) */
-export function loadPasswordPolicy(): PasswordPolicy {
-    if (_policy) return _policy;
-    const raw = loadSecurityJson();
-    _policy = passwordPolicySchema.parse(raw.password_policy ?? {});
-    return _policy;
-}
-
-// ─── 검증 ───────────────────────────────────────────────────────────────────
-
-/**
- * 비밀번호가 정책에 부합하는지 검증한다.
- *
- * @param password 평문 비밀번호
- * @param piiValues PII 필드값 배열 (예: ["01012345678", "19900101"])
- *                  pii_check.enabled 시 비밀번호에 포함 여부를 검사한다.
- * @returns null (통과) | 에러 메시지 문자열
- */
-export function validatePassword(
-    password: string,
-    piiValues: string[] = [],
-): string | null {
-    const p = loadPasswordPolicy();
-    if (!p.enabled) return null;
-
-    // 길이
-    if (p.min_length > 0 && password.length < p.min_length) {
-        return `비밀번호는 최소 ${p.min_length}자 이상이어야 합니다`;
-    }
-    if (p.max_length > 0 && password.length > p.max_length) {
-        return `비밀번호는 ${p.max_length}자를 초과할 수 없습니다`;
-    }
-
-    // 대소문자 혼합
-    if (p.require_mixed_case) {
-        if (!/[A-Z]/.test(password) || !/[a-z]/.test(password)) {
-            return "비밀번호에 대소문자를 모두 포함해야 합니다";
-        }
-    }
-
-    // 숫자 포함
-    if (p.require_number) {
-        if (!/\d/.test(password)) {
-            return "비밀번호에 숫자가 포함되어야 합니다";
-        }
-    }
-
-    // 특수문자 포함
-    if (p.require_special) {
-        if (!/[^A-Za-z0-9]/.test(password)) {
-            return "비밀번호에 특수문자가 포함되어야 합니다";
-        }
-    }
-
-    // 금지 패턴
-    const fpErr = validateForbiddenPatterns(password, p.forbidden_patterns);
-    if (fpErr) return fpErr;
-
-    // PII 포함 검사
-    if (p.pii_check.enabled && piiValues.length > 0) {
-        const lower = password.toLowerCase();
-        for (const val of piiValues) {
-            const digits = val.replace(/\D/g, "");
-            if (digits.length >= 4 && lower.includes(digits)) {
-                return "비밀번호에 개인정보(전화번호, 생년월일 등)를 포함할 수 없습니다";
-            }
-            if (val.length >= 4 && lower.includes(val.toLowerCase())) {
-                return "비밀번호에 개인정보(전화번호, 생년월일 등)를 포함할 수 없습니다";
-            }
-        }
-    }
-
-    return null;
-}
-
-// ─── 금지 패턴 내부 함수 ─────────────────────────────────────────────────────
-
-function validateForbiddenPatterns(
-    password: string,
-    cfg: PasswordPolicy["forbidden_patterns"],
-): string | null {
-    const seqLen = cfg.sequential_length;
-
-    // 연속 숫자 (1234, 4321 등)
-    if (cfg.sequential_digits) {
-        for (let i = 0; i <= password.length - seqLen; i++) {
-            const sub = password.slice(i, i + seqLen);
-            if (
-                isSequentialDigits(sub, true) ||
-                isSequentialDigits(sub, false)
-            ) {
-                return `연속된 숫자(${seqLen}자 이상)는 사용할 수 없습니다`;
-            }
-        }
-    }
-
-    // 반복 문자 (aaaa, 1111 등)
-    if (cfg.repeated_chars) {
-        for (let i = 0; i <= password.length - seqLen; i++) {
-            let allSame = true;
-            for (let j = 1; j < seqLen; j++) {
-                if (password[i + j] !== password[i]) {
-                    allSame = false;
-                    break;
-                }
-            }
-            if (allSame) {
-                return `동일한 문자의 반복(${seqLen}자 이상)은 사용할 수 없습니다`;
-            }
-        }
-    }
-
-    // 키보드 패턴 (qwer, asdf 등)
-    if (cfg.keyboard_patterns) {
-        const rows = ["qwertyuiop", "asdfghjkl", "zxcvbnm", "1234567890"];
-        const lower = password.toLowerCase();
-        for (const row of rows) {
-            for (let s = 0; s <= row.length - seqLen; s++) {
-                const pattern = row.slice(s, s + seqLen);
-                const reversed = pattern.split("").reverse().join("");
-                if (lower.includes(pattern) || lower.includes(reversed)) {
-                    return `키보드 연속 문자(${seqLen}자 이상)는 사용할 수 없습니다`;
-                }
-            }
-        }
-    }
-
-    return null;
-}
-
-/** 숫자 문자열이 오름차(ascending) 또는 내림차인지 검사 */
-function isSequentialDigits(s: string, ascending: boolean): boolean {
-    for (const ch of s) {
-        if (ch < "0" || ch > "9") return false;
-    }
-    for (let i = 1; i < s.length; i++) {
-        const diff = s.charCodeAt(i) - s.charCodeAt(i - 1);
-        if (ascending ? diff !== 1 : diff !== -1) return false;
-    }
-    return true;
-}