create-entity-app-server 0.0.3

package/src/app/plugins/oauth/handlers/callback.ts

@@ -0,0 +1,314 @@
+/**
+ * GET/POST /api/v1/oauth/:provider/callback
+ *
+ * OAuth 콜백 처리 → JWT 발급 (또는 2FA 토큰)
+ *
+ * Go auth_handler.go HandleOAuthCallback 포팅
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import jwt from "jsonwebtoken";
+import { randomBytes } from "node:crypto";
+import { entityServer, logger } from "@gateway/api";
+import { env } from "@gateway/api";
+import { getOAuthConfig, getProvider, buildCallbackUrl } from "../config.ts";
+import { validateState } from "../state.ts";
+import { exchangeCode, getUserInfo } from "../providers/index.ts";
+import { upsertOAuthAccount } from "../upsert.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+/* ──────────── 2FA config 지연 로드 ──────────── */
+
+interface TwoFactorConfig {
+    enabled: boolean;
+    setup_token_ttl_sec: number;
+    jwt_access_ttl_sec: number;
+    jwt_refresh_ttl_sec: number;
+    jwt_issuer: string;
+}
+
+let _twoFactorConfig: TwoFactorConfig | null | undefined;
+
+function loadTwoFactorConfig(): TwoFactorConfig | null {
+    if (_twoFactorConfig !== undefined) return _twoFactorConfig;
+    const cfgPath = resolve(
+        __dirname,
+        "..",
+        "..",
+        "account",
+        "2fa",
+        "config.json",
+    );
+    if (!existsSync(cfgPath)) {
+        _twoFactorConfig = null;
+        return null;
+    }
+    try {
+        _twoFactorConfig = JSON.parse(
+            readFileSync(cfgPath, "utf-8"),
+        ) as TwoFactorConfig;
+    } catch {
+        _twoFactorConfig = null;
+    }
+    return _twoFactorConfig;
+}
+
+/* ──────────── 토큰 발급 ──────────── */
+
+function issueTokenPair(
+    account: Record<string, unknown>,
+    cfg: TwoFactorConfig,
+): { access_token: string; refresh_token: string; expires_in: number } {
+    const now = Math.floor(Date.now() / 1000);
+    const seq = account.seq as number;
+
+    const accessToken = jwt.sign(
+        {
+            email: account.email ?? "",
+            name: account.name ?? account.email ?? "",
+            rbac_role: account.rbac_role ?? "",
+            license_seq: account.license_seq ?? 0,
+            iss: cfg.jwt_issuer,
+            iat: now,
+            exp: now + cfg.jwt_access_ttl_sec,
+        },
+        env.JWT_SECRET,
+        { subject: String(seq), algorithm: "HS256" },
+    );
+
+    const refreshToken = jwt.sign(
+        {
+            jti: randomBytes(16).toString("hex"),
+            iss: cfg.jwt_issuer,
+            iat: now,
+            exp: now + cfg.jwt_refresh_ttl_sec,
+        },
+        env.JWT_SECRET,
+        { subject: String(seq), algorithm: "HS256" },
+    );
+
+    return {
+        access_token: accessToken,
+        refresh_token: refreshToken,
+        expires_in: cfg.jwt_access_ttl_sec,
+    };
+}
+
+function generateSpecialToken(
+    accountSeq: number,
+    purpose: "2fa_verify" | "2fa_setup",
+    ttlSec: number,
+): string {
+    return jwt.sign({ purpose }, env.JWT_SECRET, {
+        subject: String(accountSeq),
+        expiresIn: ttlSec,
+    });
+}
+
+/* ──────────── 리다이렉트 헬퍼 ──────────── */
+
+function appendQuery(base: string, params: Record<string, string>): string {
+    const url = new URL(base.includes("://") ? base : `http://dummy${base}`);
+    for (const [k, v] of Object.entries(params)) url.searchParams.set(k, v);
+    const result = url.toString();
+    return base.includes("://") ? result : result.replace("http://dummy", "");
+}
+
+function failureRedirect(
+    reply: FastifyReply,
+    failureUrl: string | undefined,
+    message: string,
+): void {
+    if (failureUrl) {
+        reply.redirect(appendQuery(failureUrl, { error: message }), 302);
+    } else {
+        reply.code(400).send({ ok: false, error: message });
+    }
+}
+
+/* ──────────── 콜백 핸들러 ──────────── */
+
+export async function handleOAuthCallback(
+    req: FastifyRequest<{ Params: { provider: string } }>,
+    reply: FastifyReply,
+): Promise<void> {
+    const cfg = getOAuthConfig();
+    const provider = req.params.provider.toLowerCase();
+    const successUrl = cfg?.success_redirect_url;
+    const failureUrl = cfg?.failure_redirect_url;
+
+    if (!cfg?.enabled || !getProvider(provider)) {
+        return failureRedirect(reply, failureUrl, "OAuth is not configured");
+    }
+
+    // state 검증 (Apple은 POST form)
+    const rawState =
+        (req.query as Record<string, string>).state ||
+        (req.body as Record<string, string>)?.state ||
+        "";
+    let codeVerifier = "";
+    if (rawState) {
+        try {
+            ({ codeVerifier } = validateState(rawState, provider));
+        } catch (err) {
+            logger.warn({ provider, err }, "OAuth state validation failed");
+            return failureRedirect(reply, failureUrl, "Invalid OAuth state");
+        }
+    }
+
+    // authorization code
+    const code =
+        (req.query as Record<string, string>).code ||
+        (req.body as Record<string, string>)?.code ||
+        "";
+    if (!code) {
+        const errMsg =
+            (req.query as Record<string, string>).error_description ||
+            (req.body as Record<string, string>)?.error_description ||
+            (req.query as Record<string, string>).error ||
+            "OAuth authorization denied";
+        logger.warn({ provider, errMsg }, "OAuth callback: no code");
+        return failureRedirect(reply, failureUrl, errMsg);
+    }
+
+    const extraUserJSON = (req.body as Record<string, string>)?.user || ""; // Apple
+
+    // 토큰 교환
+    let token;
+    try {
+        token = await exchangeCode({
+            provider,
+            code,
+            redirectUri: buildCallbackUrl(provider),
+            codeVerifier: codeVerifier || undefined,
+        });
+    } catch (err) {
+        logger.error({ provider, err }, "OAuth token exchange failed");
+        return failureRedirect(
+            reply,
+            failureUrl,
+            "Failed to retrieve OAuth user info",
+        );
+    }
+
+    // 사용자 정보 조회
+    let userInfo;
+    try {
+        userInfo = await getUserInfo(provider, token, extraUserJSON);
+    } catch (err) {
+        logger.error({ provider, err }, "OAuth getUserInfo failed");
+        return failureRedirect(
+            reply,
+            failureUrl,
+            "Failed to retrieve OAuth user info",
+        );
+    }
+
+    if (!userInfo.email) {
+        return failureRedirect(
+            reply,
+            failureUrl,
+            "OAuth provider did not return an email address",
+        );
+    }
+
+    // account upsert
+    let account: Record<string, unknown>;
+    try {
+        account = (await upsertOAuthAccount(userInfo)) as Record<
+            string,
+            unknown
+        >;
+    } catch (err) {
+        logger.error({ provider, err }, "OAuth upsert account failed");
+        return failureRedirect(
+            reply,
+            failureUrl,
+            "Failed to register OAuth user",
+        );
+    }
+
+    // 계정 상태 확인
+    const status = String(account.status ?? "");
+    if (status && status !== "active") {
+        if (status === "dormant") {
+            return failureRedirect(
+                reply,
+                failureUrl,
+                "Account is dormant. Use POST /api/v1/auth/reactivate to reactivate.",
+            );
+        }
+        return failureRedirect(reply, failureUrl, "Account is not active");
+    }
+
+    const accountSeq = Number(account.seq);
+    const entityRole = String(account.rbac_role ?? "").trim();
+    if (!entityRole) {
+        logger.error({ email: userInfo.email }, "OAuth: missing rbac_role");
+        return failureRedirect(
+            reply,
+            failureUrl,
+            "Account role is not configured",
+        );
+    }
+
+    // 2FA 분기
+    const tfaCfg = loadTwoFactorConfig();
+    if (tfaCfg?.enabled) {
+        const totpEnabled = account.totp_enabled === true;
+
+        if (totpEnabled) {
+            const twoFactorToken = generateSpecialToken(
+                accountSeq,
+                "2fa_verify",
+                tfaCfg.setup_token_ttl_sec,
+            );
+            if (successUrl) {
+                return reply.redirect(
+                    appendQuery(successUrl, {
+                        "2fa_required": "true",
+                        "2fa_token": twoFactorToken,
+                    }),
+                    302,
+                );
+            }
+            reply.send({
+                ok: true,
+                requires_2fa: true,
+                data: {
+                    two_factor_token: twoFactorToken,
+                    expires_in: tfaCfg.setup_token_ttl_sec,
+                },
+            });
+            return;
+        }
+    }
+
+    // JWT 발급
+    const tokenConfig = tfaCfg ?? {
+        jwt_access_ttl_sec: 3600,
+        jwt_refresh_ttl_sec: 1_209_600,
+        jwt_issuer: "entity-server",
+    };
+
+    const tokenPair = issueTokenPair(account, tokenConfig as TwoFactorConfig);
+
+    if (successUrl) {
+        return reply.redirect(
+            appendQuery(successUrl, {
+                access_token: tokenPair.access_token,
+                refresh_token: tokenPair.refresh_token,
+            }),
+            302,
+        );
+    }
+
+    reply
+        .header("X-Access-Token", tokenPair.access_token)
+        .header("X-Refresh-Token", tokenPair.refresh_token)
+        .send({ ok: true, data: tokenPair });
+}

package/src/app/plugins/oauth/handlers/index.ts

@@ -0,0 +1,2 @@
+export { handleOAuthRedirect } from "./redirect.ts";
+export { handleOAuthCallback } from "./callback.ts";

package/src/app/plugins/oauth/handlers/redirect.ts

@@ -0,0 +1,47 @@
+/**
+ * GET /api/v1/oauth/:provider
+ *
+ * OAuth 프로바이더로 리다이렉트
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { logger } from "@gateway/api";
+import { getProvider, buildCallbackUrl } from "../config.ts";
+import {
+    generateCodeVerifier,
+    codeChallenge,
+    generateState,
+} from "../state.ts";
+import { buildAuthUrl } from "../providers/index.ts";
+
+export async function handleOAuthRedirect(
+    req: FastifyRequest<{ Params: { provider: string } }>,
+    reply: FastifyReply,
+): Promise<void> {
+    const provider = req.params.provider.toLowerCase();
+    const p = getProvider(provider);
+    if (!p) {
+        reply.code(400).send({
+            ok: false,
+            error: `Unsupported OAuth provider: ${provider}`,
+        });
+        return;
+    }
+
+    const redirectUri = buildCallbackUrl(provider);
+    const needPkce = p.pkce === true;
+    const verifier = needPkce ? generateCodeVerifier() : "";
+    const challenge = needPkce ? codeChallenge(verifier) : undefined;
+
+    const state = generateState(provider, verifier);
+
+    const url = buildAuthUrl({
+        provider,
+        redirectUri,
+        state,
+        codeChallenge: challenge,
+    });
+
+    logger.debug({ provider, redirectUri }, "OAuth redirect");
+    reply.redirect(url, 302);
+}

package/src/app/plugins/oauth/index.ts

@@ -0,0 +1,74 @@
+/**
+ * OAuth 플러그인
+ *
+ * 두 가지 라우트 트리를 등록한다:
+ *   1. /api/v1/oauth/:provider          → 소셜 로그인 (redirect + callback)
+ *   2. /api/v1/account/oauth/*          → 계정 OAuth 연동 관리 (link/unlink/providers/refresh)
+ *
+ * 플러그인 config.json 의 enabled: true 일 때만 활성화된다.
+ */
+
+import fp from "fastify-plugin";
+import type { FastifyInstance } from "fastify";
+import { readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { isOAuthEnabled } from "./config.ts";
+import {
+    ensurePluginEntities,
+    registerWithdrawHook,
+    entityServer,
+} from "@gateway/api";
+import { oauthLoginRoutes, accountOAuthRoutes } from "./routes.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+function isPluginEnabled(): boolean {
+    try {
+        const raw = readFileSync(join(__dirname, "config.json"), "utf-8");
+        return JSON.parse(raw)?.enabled === true;
+    } catch {
+        return false;
+    }
+}
+
+export default fp(
+    async (app: FastifyInstance) => {
+        if (!isPluginEnabled()) {
+            app.log.info("OAuth plugin: disabled (config.json enabled=false)");
+            return;
+        }
+
+        if (!isOAuthEnabled()) {
+            app.log.info("OAuth plugin: disabled (config.json enabled=false)");
+            return;
+        }
+
+        // entities/ 폴더의 엔티티 JSON을 Go 엔티티 서버에 자동 등록
+        await ensurePluginEntities(__dirname).catch((err) =>
+            app.log.warn({ err }, "OAuth: entity setup failed, continuing"),
+        );
+
+        // 탈퇴 시 account_oauth 레코드 삭제
+        registerWithdrawHook("oauth", async (accountSeq) => {
+            const res = await entityServer.list<{ seq: number }>(
+                "account_oauth",
+                {
+                    conditions: { account_seq: accountSeq },
+                },
+            );
+            const items = (res?.data?.items ?? []) as { seq: number }[];
+            await Promise.all(
+                items.map((item) =>
+                    entityServer.delete("account_oauth", item.seq),
+                ),
+            );
+        });
+
+        await app.register(oauthLoginRoutes, { prefix: "/api/v1/oauth" });
+        await app.register(accountOAuthRoutes, {
+            prefix: "/api/v1/account/oauth",
+        });
+    },
+    { name: "oauth-plugin" },
+);