create-entity-app-server 0.0.3

package/src/app/plugins/llm/types/usage.ts

@@ -0,0 +1,27 @@
+export interface LlmUsageRecord {
+    providerName: string;
+    model: string;
+    promptTokens: number;
+    completionTokens: number;
+    totalTokens: number;
+    callerService?: string;
+    requestTimeMs: number;
+    status: "success" | "error" | "timeout";
+    errorMessage?: string;
+    userSeq?: number;
+    estimatedCost?: number;
+    requestedAt: string;
+}
+
+export interface UsageFilter {
+    providerName?: string;
+    callerService?: string;
+    dateFrom?: string;
+    dateTo?: string;
+}
+
+export interface UsageSummary {
+    totalRequests: number;
+    totalTokens: number;
+    estimatedCostUsd: number;
+}

package/src/app/plugins/llm/usage-store.ts

@@ -0,0 +1,64 @@
+/**
+ * LLM 사용량 추적 — Entity Server 어댑터
+ *
+ * llm_usage 엔티티를 통한 API 호출 사용량 기록 및 집계
+ */
+
+import { entityServer } from "@gateway/api";
+import { logger } from "@gateway/api";
+import type {
+    UsageQuerier,
+    LlmUsageRecord,
+    UsageSummary,
+    UsageFilter,
+} from "./types/index.ts";
+
+export class UsageEntityAdapter implements UsageQuerier {
+    /** 사용량 기록을 저장한다 */
+    async recordUsage(r: LlmUsageRecord): Promise<void> {
+        const data: Record<string, unknown> = {
+            provider_name: r.providerName,
+            model: r.model,
+            caller_service: r.callerService ?? "",
+            prompt_tokens: r.promptTokens,
+            completion_tokens: r.completionTokens,
+            total_tokens: r.totalTokens,
+            request_time_ms: r.requestTimeMs,
+            status: r.status,
+            estimated_cost: r.estimatedCost ?? 0,
+        };
+        if (r.userSeq) data.user_seq = r.userSeq;
+        if (r.errorMessage) data.error_message = r.errorMessage;
+
+        try {
+            await entityServer.submit("llm_usage", data);
+        } catch (err) {
+            logger.error({ err }, "Failed to record LLM usage");
+        }
+    }
+
+    /** 사용량 요약을 조회한다 */
+    async getUsageSummary(filter: UsageFilter): Promise<UsageSummary> {
+        const opts: Record<string, unknown> = { limit: 10000 };
+        if (filter.providerName) opts.provider_name = filter.providerName;
+        if (filter.callerService) opts.caller_service = filter.callerService;
+        if (filter.dateFrom) opts.created_time_gte = filter.dateFrom;
+        if (filter.dateTo) opts.created_time_lte = filter.dateTo;
+
+        const resp = await entityServer.list("llm_usage", opts);
+        const rows = (resp.data as any)?.items ?? [];
+
+        let totalTokens = 0;
+        let estimatedCostUsd = 0;
+        for (const row of rows) {
+            totalTokens += Number(row.total_tokens ?? 0);
+            estimatedCostUsd += Number(row.estimated_cost ?? 0);
+        }
+
+        return {
+            totalRequests: rows.length,
+            totalTokens,
+            estimatedCostUsd,
+        };
+    }
+}

package/src/app/plugins/oauth/account/handlers/index.ts

@@ -0,0 +1,4 @@
+export { handleOAuthLink } from "./link.ts";
+export { handleOAuthUnlink } from "./unlink.ts";
+export { handleOAuthProviders } from "./providers-list.ts";
+export { handleOAuthTokenRefresh } from "./refresh.ts";

package/src/app/plugins/oauth/account/handlers/link.ts

@@ -0,0 +1,165 @@
+/**
+ * POST /api/v1/account/oauth/link
+ *
+ * 로그인된 계정에 OAuth 프로바이더를 연동한다.
+ *
+ * Go auth_handler.go HandleOAuthLink 포팅
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { entityServer, logger, ok, fail } from "@gateway/api";
+import { getAccountSeqFromJwt } from "../../../../routes/email-verify/handlers/utils.ts";
+import { validateState } from "../../state.ts";
+import { getProvider, buildCallbackUrl } from "../../config.ts";
+import { exchangeCode, getUserInfo } from "../../providers/index.ts";
+
+interface LinkBody {
+    provider?: string;
+    code?: string;
+    state?: string;
+    redirect_uri?: string;
+}
+
+interface OAuthRow {
+    seq: number;
+    account_seq: number;
+    provider: string;
+    provider_id: string;
+    status?: string;
+}
+
+export async function handleOAuthLink(
+    req: FastifyRequest,
+    reply: FastifyReply,
+): Promise<void> {
+    const accountSeq = getAccountSeqFromJwt(req);
+    if (!accountSeq) {
+        reply.code(401).send(fail("Not authenticated"));
+        return;
+    }
+
+    const body = (req.body as LinkBody) ?? {};
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    const code = (body.code ?? "").trim();
+    if (!provider || !code) {
+        reply.code(400).send(fail("provider and code are required"));
+        return;
+    }
+    if (!getProvider(provider)) {
+        reply.code(400).send(fail(`Unsupported OAuth provider: ${provider}`));
+        return;
+    }
+
+    // state CSRF 검증 (선택)
+    if (body.state) {
+        try {
+            validateState(body.state, provider);
+        } catch (err) {
+            logger.warn(
+                { provider, err },
+                "OAuth link: state validation failed",
+            );
+            reply.code(400).send(fail("Invalid OAuth state"));
+            return;
+        }
+    }
+
+    // 토큰 교환 + 사용자 정보 조회
+    let userInfo;
+    try {
+        const redirectUri = body.redirect_uri || buildCallbackUrl(provider);
+        const token = await exchangeCode({ provider, code, redirectUri });
+        userInfo = await getUserInfo(provider, token);
+    } catch (err) {
+        logger.error({ provider, err }, "OAuth link: exchange failed");
+        reply.code(500).send(fail("Failed to retrieve OAuth user info"));
+        return;
+    }
+
+    // 이미 연동된 프로바이더 확인
+    let existingItems: OAuthRow[] = [];
+    try {
+        const existing = await entityServer.list<OAuthRow>("account_oauth", {
+            conditions: { account_seq: accountSeq, provider },
+            limit: 1,
+        });
+        existingItems = (existing?.data?.items ?? []) as OAuthRow[];
+    } catch {
+        // account_oauth 엔티티 없는 환경
+    }
+
+    if (existingItems.length > 0) {
+        const item = existingItems[0]!;
+        if (String(item.status) === "active") {
+            reply.code(409).send(fail("Provider already linked"));
+            return;
+        }
+        // unlinked → 재활성화
+        const reactivateData: Record<string, unknown> = {
+            seq: item.seq,
+            provider_id: userInfo.provider_id,
+            email: userInfo.email,
+            name: userInfo.name,
+            profile_image: userInfo.profile_image,
+            status: "active",
+            linked_at: "now()",
+            unlinked_at: null,
+        };
+        if (userInfo.access_token)
+            reactivateData.access_token = userInfo.access_token;
+        if (userInfo.refresh_token)
+            reactivateData.refresh_token = userInfo.refresh_token;
+        if (userInfo.token_expires_at)
+            reactivateData.token_expires_at = userInfo.token_expires_at;
+        await entityServer.submit("account_oauth", reactivateData);
+        reply.send(ok({ message: "Provider re-linked" }));
+        return;
+    }
+
+    // 다른 계정에 이미 연동된 provider_id 확인
+    try {
+        const other = await entityServer.list<OAuthRow>("account_oauth", {
+            conditions: { provider, provider_id: userInfo.provider_id },
+            limit: 1,
+        });
+        const otherItems = (other?.data?.items ?? []) as OAuthRow[];
+        if (otherItems.length > 0) {
+            reply
+                .code(409)
+                .send(
+                    fail(
+                        "This OAuth account is already linked to another account",
+                    ),
+                );
+            return;
+        }
+    } catch {
+        // ignore
+    }
+
+    // 새 연동 레코드 생성
+    const linkData: Record<string, unknown> = {
+        account_seq: accountSeq,
+        provider: userInfo.provider,
+        provider_id: userInfo.provider_id,
+        email: userInfo.email,
+        name: userInfo.name,
+        profile_image: userInfo.profile_image,
+        status: "active",
+        linked_at: "now()",
+    };
+    if (userInfo.access_token) linkData.access_token = userInfo.access_token;
+    if (userInfo.refresh_token) linkData.refresh_token = userInfo.refresh_token;
+    if (userInfo.token_expires_at)
+        linkData.token_expires_at = userInfo.token_expires_at;
+
+    try {
+        await entityServer.submit("account_oauth", linkData);
+    } catch (err) {
+        logger.error({ err }, "OAuth link: failed to create account_oauth");
+        reply.code(500).send(fail("Failed to link provider"));
+        return;
+    }
+
+    reply.send(ok({ message: "Provider linked", provider }));
+}

package/src/app/plugins/oauth/account/handlers/providers-list.ts

@@ -0,0 +1,49 @@
+/**
+ * GET /api/v1/account/oauth/providers
+ *
+ * 로그인된 계정에 연동된 OAuth 프로바이더 목록 반환
+ *
+ * Go auth_handler.go HandleOAuthProviders 포팅
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { entityServer, logger, ok, fail } from "@gateway/api";
+import { getAccountSeqFromJwt } from "../../../../routes/email-verify/handlers/utils.ts";
+
+interface OAuthRow {
+    provider?: string;
+    email?: string;
+    name?: string;
+    profile_image?: string;
+    linked_at?: string;
+}
+
+export async function handleOAuthProviders(
+    req: FastifyRequest,
+    reply: FastifyReply,
+): Promise<void> {
+    const accountSeq = getAccountSeqFromJwt(req);
+    if (!accountSeq) {
+        reply.code(401).send(fail("Not authenticated"));
+        return;
+    }
+
+    try {
+        const res = await entityServer.list<OAuthRow>("account_oauth", {
+            conditions: { account_seq: accountSeq, status: "active" },
+            limit: 100,
+        });
+        const items = (res?.data?.items ?? []) as OAuthRow[];
+        const providers = items.map((item) => ({
+            provider: item.provider,
+            email: item.email,
+            name: item.name,
+            profile_image: item.profile_image,
+            linked_at: item.linked_at,
+        }));
+        reply.send(ok(providers));
+    } catch (err) {
+        logger.error({ err }, "OAuthProviders: list failed");
+        reply.code(500).send(fail("Failed to query linked providers"));
+    }
+}

package/src/app/plugins/oauth/account/handlers/refresh.ts

@@ -0,0 +1,92 @@
+/**
+ * POST /api/v1/account/oauth/refresh/:provider
+ *
+ * OAuth 프로바이더 access_token을 refresh_token으로 갱신하고
+ * account_oauth 레코드를 업데이트한다.
+ *
+ * Go auth_handler.go HandleOAuthTokenRefresh 포팅
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { entityServer, logger, ok, fail } from "@gateway/api";
+import { getAccountSeqFromJwt } from "../../../../routes/email-verify/handlers/utils.ts";
+import { refreshProviderToken } from "../../providers/index.ts";
+
+interface OAuthRow {
+    seq: number;
+    refresh_token?: string;
+}
+
+export async function handleOAuthTokenRefresh(
+    req: FastifyRequest,
+    reply: FastifyReply,
+): Promise<void> {
+    const accountSeq = getAccountSeqFromJwt(req);
+    if (!accountSeq) {
+        reply.code(401).send(fail("Not authenticated"));
+        return;
+    }
+
+    const provider = ((req.params as { provider?: string })?.provider ?? "")
+        .trim()
+        .toLowerCase();
+    if (!provider) {
+        reply.code(400).send(fail("provider is required"));
+        return;
+    }
+
+    // account_oauth에서 refresh_token 조회
+    let item: OAuthRow | null = null;
+    try {
+        const res = await entityServer.list<OAuthRow>("account_oauth", {
+            conditions: { account_seq: accountSeq, provider, status: "active" },
+            limit: 1,
+        });
+        item = ((res?.data?.items ?? []) as OAuthRow[])[0] ?? null;
+    } catch (err) {
+        logger.error({ err }, "OAuthRefresh: list account_oauth failed");
+    }
+
+    if (!item) {
+        reply.code(404).send(fail("Provider link not found"));
+        return;
+    }
+
+    const storedRefreshToken = item.refresh_token ?? "";
+    if (!storedRefreshToken || storedRefreshToken === "<nil>") {
+        reply.code(400).send(fail("No refresh_token stored for this provider"));
+        return;
+    }
+
+    let newToken;
+    try {
+        newToken = await refreshProviderToken(provider, storedRefreshToken);
+    } catch (err) {
+        logger.error({ provider, err }, "OAuthRefresh: token refresh failed");
+        reply.code(502).send(fail("Failed to refresh OAuth token"));
+        return;
+    }
+
+    const updateData: Record<string, unknown> = {
+        seq: item.seq,
+        access_token: newToken.access_token,
+    };
+    if (newToken.refresh_token)
+        updateData.refresh_token = newToken.refresh_token;
+
+    let tokenExpiresAt = "";
+    if (newToken.expires_in) {
+        tokenExpiresAt = new Date(
+            Date.now() + newToken.expires_in * 1000,
+        ).toISOString();
+        updateData.token_expires_at = tokenExpiresAt;
+    }
+
+    try {
+        await entityServer.submit("account_oauth", updateData);
+    } catch (err) {
+        logger.warn({ err }, "OAuthRefresh: failed to update account_oauth");
+    }
+
+    reply.send(ok({ provider, token_expires_at: tokenExpiresAt }));
+}

package/src/app/plugins/oauth/account/handlers/unlink.ts

@@ -0,0 +1,105 @@
+/**
+ * DELETE /api/v1/account/oauth/link/:provider
+ *
+ * 로그인된 계정에서 OAuth 프로바이더 연동을 해제한다.
+ * 비밀번호 또는 다른 활성 소셜 연동이 없으면 해제 불가.
+ *
+ * Go auth_handler.go HandleOAuthUnlink 포팅
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { entityServer, logger, ok, fail } from "@gateway/api";
+import { getAccountSeqFromJwt } from "../../../../routes/email-verify/handlers/utils.ts";
+
+interface OAuthRow {
+    seq: number;
+    provider: string;
+    status?: string;
+}
+
+interface AccountRow {
+    has_password?: boolean | number;
+    passwd?: string;
+}
+
+export async function handleOAuthUnlink(
+    req: FastifyRequest,
+    reply: FastifyReply,
+): Promise<void> {
+    const accountSeq = getAccountSeqFromJwt(req);
+    if (!accountSeq) {
+        reply.code(401).send(fail("Not authenticated"));
+        return;
+    }
+
+    const provider = ((req.params as { provider?: string })?.provider ?? "")
+        .trim()
+        .toLowerCase();
+    if (!provider) {
+        reply.code(400).send(fail("provider is required"));
+        return;
+    }
+
+    // 연동 레코드 확인
+    let linkItem: OAuthRow | null = null;
+    try {
+        const res = await entityServer.list<OAuthRow>("account_oauth", {
+            conditions: { account_seq: accountSeq, provider, status: "active" },
+            limit: 1,
+        });
+        const items = (res?.data?.items ?? []) as OAuthRow[];
+        linkItem = items[0] ?? null;
+    } catch (err) {
+        logger.error({ err }, "OAuthUnlink: list account_oauth failed");
+    }
+
+    if (!linkItem) {
+        reply.code(404).send(fail("Provider link not found"));
+        return;
+    }
+
+    // 로그인 수단 0개 방지
+    try {
+        const accountRes = await entityServer.get<AccountRow>(
+            "account",
+            accountSeq,
+        );
+        const accountData = accountRes?.data;
+        const hasPassword =
+            accountData?.has_password === true ||
+            accountData?.has_password === 1 ||
+            (typeof accountData?.passwd === "string" &&
+                accountData.passwd.length > 0);
+
+        if (!hasPassword) {
+            const allRes = await entityServer.list<OAuthRow>("account_oauth", {
+                conditions: { account_seq: accountSeq, status: "active" },
+                limit: 100,
+            });
+            const allItems = (allRes?.data?.items ?? []) as OAuthRow[];
+            const otherLinks = allItems.filter(
+                (i) => i.provider !== provider,
+            ).length;
+            if (otherLinks === 0) {
+                reply
+                    .code(400)
+                    .send(
+                        fail(
+                            "Cannot unlink: no other login method available. Set a password first.",
+                        ),
+                    );
+                return;
+            }
+        }
+    } catch {
+        // account 조회 실패 시에는 해제 허용 (방어적 처리)
+    }
+
+    await entityServer.submit("account_oauth", {
+        seq: linkItem.seq,
+        status: "unlinked",
+        unlinked_at: "now()",
+    });
+
+    reply.send(ok({ message: "Provider unlinked", provider }));
+}

package/src/app/plugins/oauth/config.example.json

@@ -0,0 +1,65 @@
+{
+    "_comment": "OAuth 2.0 설정 예시. 사용할 프로바이더만 남기고 실제 값으로 교체하세요.",
+    "enabled": false,
+    "deploy": true,
+    "minify": false,
+    "state_secret": "${OAUTH_STATE_SECRET}",
+    "state_ttl_sec": 600,
+    "success_redirect_url": "${OAUTH_SUCCESS_REDIRECT_URL}",
+    "failure_redirect_url": "${OAUTH_FAILURE_REDIRECT_URL}",
+    "providers": [
+        {
+            "driver": "google",
+            "client_id": "${GOOGLE_CLIENT_ID}",
+            "client_secret": "${GOOGLE_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/google/callback",
+            "scopes": ["openid", "email", "profile"]
+        },
+        {
+            "driver": "github",
+            "client_id": "${GITHUB_CLIENT_ID}",
+            "client_secret": "${GITHUB_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/github/callback"
+        },
+        {
+            "driver": "naver",
+            "client_id": "${NAVER_CLIENT_ID}",
+            "client_secret": "${NAVER_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/naver/callback"
+        },
+        {
+            "_comment": "Kakao - custom endpoint example",
+            "driver": "kakao",
+            "client_id": "${KAKAO_CLIENT_ID}",
+            "client_secret": "${KAKAO_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/kakao/callback",
+            "auth_url": "https://kauth.kakao.com/oauth/authorize",
+            "token_url": "https://kauth.kakao.com/oauth/token",
+            "user_info_url": "https://kapi.kakao.com/v2/user/me",
+            "scopes": ["profile_nickname", "account_email"],
+            "email_field": "kakao_account.email",
+            "name_field": "properties.nickname"
+        },
+        {
+            "_comment": "Apple Sign-In - client_secret JWT is auto-generated when apple_team_id/apple_key_id/apple_private_key are set",
+            "driver": "apple",
+            "client_id": "${APPLE_CLIENT_ID}",
+            "client_secret": "",
+            "redirect_url": "/v1/oauth/apple/callback",
+            "scopes": ["name", "email"],
+            "pkce": true,
+            "apple_team_id": "${APPLE_TEAM_ID}",
+            "apple_key_id": "${APPLE_KEY_ID}",
+            "apple_private_key": "${APPLE_PRIVATE_KEY}"
+        },
+        {
+            "_comment": "Line Login v2.1 - openid + email recommended",
+            "driver": "line",
+            "client_id": "${LINE_CLIENT_ID}",
+            "client_secret": "${LINE_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/line/callback",
+            "scopes": ["openid", "profile", "email"],
+            "pkce": true
+        }
+    ]
+}

package/src/app/plugins/oauth/config.json

@@ -0,0 +1,72 @@
+{
+    "_comment": "OAuth 2.0 설정. 앱서버 OAuth 플러그인에서 직접 사용합니다.",
+    "enabled": false,
+    "deploy": true,
+    "minify": false,
+    "state_secret": "${OAUTH_STATE_SECRET}",
+    "state_ttl_sec": 600,
+    "success_redirect_url": "${OAUTH_SUCCESS_REDIRECT_URL}",
+    "failure_redirect_url": "${OAUTH_FAILURE_REDIRECT_URL}",
+    "providers": [
+        {
+            "driver": "google",
+            "client_id": "${GOOGLE_CLIENT_ID}",
+            "client_secret": "${GOOGLE_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/google/callback",
+            "scopes": ["openid", "email", "profile"]
+        },
+        {
+            "driver": "github",
+            "client_id": "${GITHUB_CLIENT_ID}",
+            "client_secret": "${GITHUB_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/github/callback"
+        },
+        {
+            "driver": "naver",
+            "client_id": "${NAVER_CLIENT_ID}",
+            "client_secret": "${NAVER_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/naver/callback"
+        },
+        {
+            "_comment": "Kakao - custom endpoint example",
+            "driver": "kakao",
+            "client_id": "${KAKAO_CLIENT_ID}",
+            "client_secret": "${KAKAO_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/kakao/callback",
+            "auth_url": "https://kauth.kakao.com/oauth/authorize",
+            "token_url": "https://kauth.kakao.com/oauth/token",
+            "user_info_url": "https://kapi.kakao.com/v2/user/me",
+            "scopes": ["profile_nickname", "account_email"],
+            "email_field": "kakao_account.email",
+            "name_field": "properties.nickname"
+        },
+        {
+            "_comment": "Apple Sign-In - client_secret JWT is auto-generated when apple_team_id/apple_key_id/apple_private_key are set",
+            "driver": "apple",
+            "client_id": "${APPLE_CLIENT_ID}",
+            "client_secret": "",
+            "redirect_url": "/v1/oauth/apple/callback",
+            "scopes": ["name", "email"],
+            "pkce": true,
+            "apple_team_id": "${APPLE_TEAM_ID}",
+            "apple_key_id": "${APPLE_KEY_ID}",
+            "apple_private_key": "${APPLE_PRIVATE_KEY}"
+        },
+        {
+            "driver": "linkedin",
+            "client_id": "${LINKEDIN_CLIENT_ID}",
+            "client_secret": "${LINKEDIN_CLIENT_SECRET}",
+            "redirect_url": "/api/v1/oauth/linkedin/callback",
+            "scopes": ["openid", "profile", "email"]
+        },
+        {
+            "_comment": "Line Login v2.1 - openid + email recommended",
+            "driver": "line",
+            "client_id": "${LINE_CLIENT_ID}",
+            "client_secret": "${LINE_CLIENT_SECRET}",
+            "redirect_url": "/v1/oauth/line/callback",
+            "scopes": ["openid", "profile", "email"],
+            "pkce": true
+        }
+    ]
+}