create-entity-app-server 0.0.3

package/src/app/routes/account/reactivate/config.json

@@ -0,0 +1,5 @@
+{
+    "enabled": true,
+    "deploy": true,
+    "minify": false
+}

package/src/app/routes/account/reactivate/handlers.ts

@@ -0,0 +1,249 @@
+/**
+ * 휴면 계정 재활성화 핸들러
+ *
+ * Go `POST /v1/auth/reactivate` 대체 구현.
+ * 이메일+비밀번호 또는 OAuth code 로 본인 확인 후 account.status 를 `active`로 복구하고
+ * JWT 토큰 쌍을 즉시 발급한다.
+ */
+
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { entityServer, fail, logger, ok } from "@gateway/api";
+import { issueTokenPair } from "../../../plugins/2fa/handlers/utils.ts";
+import {
+    getProvider,
+    buildCallbackUrl,
+} from "../../../plugins/oauth/config.ts";
+import { validateState } from "../../../plugins/oauth/state.ts";
+import {
+    exchangeCode,
+    getUserInfo,
+} from "../../../plugins/oauth/providers/index.ts";
+import { upsertOAuthAccount } from "../../../plugins/oauth/upsert.ts";
+import type {
+    AccountTotpFields,
+    TwoFactorConfig,
+} from "../../../plugins/2fa/types.ts";
+import { verifyPassword } from "../../password-reset/password-utils.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+interface ReactivateBody {
+    email?: string;
+    passwd?: string;
+    provider?: string;
+    code?: string;
+    state?: string;
+    redirect_uri?: string;
+}
+
+interface ReactivateAccount extends AccountTotpFields {
+    status?: string;
+    dormancy_warned_days?: number;
+}
+
+function loadTokenConfig(): TwoFactorConfig {
+    const configPath = resolve(
+        __dirname,
+        "..",
+        "..",
+        "..",
+        "plugins",
+        "2fa",
+        "config.json",
+    );
+    let raw: Record<string, unknown> = {};
+
+    if (existsSync(configPath)) {
+        const text = readFileSync(configPath, "utf-8").replace(
+            /\$\{([^}]+)\}/g,
+            (_m, name: string) => process.env[name] ?? "",
+        );
+        raw = JSON.parse(text) as Record<string, unknown>;
+    }
+
+    return {
+        enabled: raw.enabled !== false,
+        issuer: String(raw.issuer ?? "EntityServer"),
+        code_digits: Number(raw.code_digits) || 6,
+        period_sec: Number(raw.period_sec) || 30,
+        skew: Number(raw.skew) ?? 1,
+        recovery_code_count: Number(raw.recovery_code_count) || 10,
+        setup_token_ttl_sec: Number(raw.setup_token_ttl_sec) || 300,
+        max_verify_attempts: Number(raw.max_verify_attempts) || 5,
+        verify_lockout_sec: Number(raw.verify_lockout_sec) || 300,
+        jwt_access_ttl_sec: Number(raw.jwt_access_ttl_sec) || 3600,
+        jwt_refresh_ttl_sec: Number(raw.jwt_refresh_ttl_sec) || 1209600,
+        jwt_issuer: String(raw.jwt_issuer ?? "entity-server"),
+    };
+}
+
+function nowSqlString(): string {
+    return new Date()
+        .toISOString()
+        .replace("T", " ")
+        .replace(/\.\d+Z$/, "");
+}
+
+async function verifyOAuthOwnership(
+    body: ReactivateBody,
+    email: string,
+    accountSeq: number,
+): Promise<ReactivateAccount | null> {
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    const code = (body.code ?? "").trim();
+    if (!provider || !code) return null;
+    if (!getProvider(provider)) {
+        throw new Error(`Unsupported OAuth provider: ${provider}`);
+    }
+
+    let codeVerifier: string | undefined;
+    if (body.state) {
+        ({ codeVerifier } = validateState(body.state, provider));
+    }
+
+    const token = await exchangeCode({
+        provider,
+        code,
+        redirectUri: body.redirect_uri || buildCallbackUrl(provider),
+        codeVerifier,
+    });
+    const userInfo = await getUserInfo(provider, token);
+
+    if (!userInfo.email) {
+        throw new Error("OAuth provider did not return an email address");
+    }
+    if (userInfo.email.toLowerCase() !== email.toLowerCase()) {
+        throw new Error("OAuth email does not match account email");
+    }
+
+    const linkedAccount = await upsertOAuthAccount(userInfo);
+    if (Number(linkedAccount.seq) !== accountSeq) {
+        throw new Error(
+            "This OAuth account is already linked to another account",
+        );
+    }
+
+    return linkedAccount as ReactivateAccount;
+}
+
+export async function handleReactivate(
+    req: FastifyRequest<{ Body: ReactivateBody }>,
+    reply: FastifyReply,
+): Promise<void> {
+    const email = (req.body?.email ?? "").trim();
+    const passwd = (req.body?.passwd ?? "").trim();
+    const provider = (req.body?.provider ?? "").trim().toLowerCase();
+    const code = (req.body?.code ?? "").trim();
+
+    if (!email) {
+        reply.code(400).send(fail("email is required"));
+        return;
+    }
+    if (!passwd && !(provider && code)) {
+        reply.code(400).send(fail("passwd or (provider and code) is required"));
+        return;
+    }
+
+    let account: ReactivateAccount | null = null;
+    try {
+        const result = await entityServer.find<ReactivateAccount>("account", {
+            email,
+        });
+        account = result?.data ?? null;
+    } catch {
+        account = null;
+    }
+
+    if (!account) {
+        reply.code(404).send(fail("Account not found"));
+        return;
+    }
+
+    const status = String(account.status ?? "");
+    if (status !== "dormant") {
+        if (status === "active") {
+            reply.code(409).send(fail("Account is already active"));
+            return;
+        }
+        reply
+            .code(403)
+            .send(fail(`Account cannot be reactivated (status: ${status})`));
+        return;
+    }
+
+    let tokenAccount = account;
+
+    if (provider && code) {
+        try {
+            const linkedAccount = await verifyOAuthOwnership(
+                req.body ?? {},
+                email,
+                Number(account.seq),
+            );
+            if (linkedAccount) {
+                tokenAccount = { ...account, ...linkedAccount };
+            }
+        } catch (err) {
+            logger.warn(
+                { err, email, provider },
+                "Auth reactivate: OAuth verification failed",
+            );
+            const message =
+                err instanceof Error
+                    ? err.message
+                    : "OAuth verification failed";
+            const statusCode = message.startsWith("Unsupported OAuth provider")
+                ? 400
+                : message ===
+                    "This OAuth account is already linked to another account"
+                  ? 409
+                  : 401;
+            reply.code(statusCode).send(fail(message));
+            return;
+        }
+    } else {
+        if (!account.passwd || !verifyPassword(passwd, account.passwd)) {
+            reply.code(401).send(fail("Invalid password"));
+            return;
+        }
+    }
+
+    try {
+        await entityServer.submit("account", {
+            seq: account.seq,
+            status: "active",
+            last_login_time: nowSqlString(),
+            dormancy_warned_days: 0,
+        });
+    } catch (err) {
+        logger.error(
+            { err, accountSeq: account.seq },
+            "Auth reactivate: failed to update account",
+        );
+        reply.code(500).send(fail("Failed to reactivate account"));
+        return;
+    }
+
+    const tokenPair = issueTokenPair(
+        {
+            ...tokenAccount,
+            name: tokenAccount.name ?? tokenAccount.email,
+            rbac_role: (tokenAccount.rbac_role ?? "").trim() || "user",
+            license_seq: Number(tokenAccount.license_seq ?? 0),
+        },
+        loadTokenConfig(),
+    );
+
+    logger.info(
+        { accountSeq: account.seq, email },
+        "Auth reactivate: account reactivated",
+    );
+
+    reply
+        .header("X-Access-Token", tokenPair.access_token)
+        .header("X-Refresh-Token", tokenPair.refresh_token)
+        .send(ok(tokenPair));
+}

package/src/app/routes/account/reactivate/routes.ts

@@ -0,0 +1,14 @@
+/**
+ * 휴면 계정 재활성화 라우트
+ *
+ *   POST /api/v1/account/reactivate
+ */
+
+import type { FastifyInstance } from "fastify";
+import { handleReactivate } from "./handlers.ts";
+
+export default async function reactivatePlugin(
+    app: FastifyInstance,
+): Promise<void> {
+    app.post("/", handleReactivate);
+}

package/src/app/routes/account/register/config-loader.ts

@@ -0,0 +1,34 @@
+/**
+ * register 설정 로더
+ *
+ * email-verify confirm/activate 등 외부 모듈에서도
+ * register config(send_welcome_email, welcome_email_subject 등)를 읽을 수 있도록 분리.
+ */
+
+import { readFileSync, existsSync } from "node:fs";
+import { resolve, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import type { RegisterConfig } from "./types/index.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+export function loadRegisterConfig(): RegisterConfig {
+    const configPath = resolve(__dirname, "config.json");
+    let raw: Record<string, unknown> = {};
+    if (existsSync(configPath)) {
+        const text = readFileSync(configPath, "utf-8").replace(
+            /\$\{([^}]+)\}/g,
+            (_m, name) => process.env[name] ?? "",
+        );
+        raw = JSON.parse(text) as Record<string, unknown>;
+    }
+
+    return {
+        enabled: raw.enabled !== false,
+        send_welcome_email: raw.send_welcome_email === true,
+        welcome_email_subject: String(
+            raw.welcome_email_subject ?? "가입을 환영합니다!",
+        ),
+        default_role: String(raw.default_role ?? "user"),
+    };
+}

package/src/app/routes/account/register/config.json

@@ -0,0 +1,8 @@
+{
+    "enabled": true,
+    "send_welcome_email": false,
+    "welcome_email_subject": "가입을 환영합니다!",
+    "default_role": "user",
+    "deploy": true,
+    "minify": false
+}

package/src/app/routes/account/register/handlers.ts

@@ -0,0 +1,207 @@
+/**
+ * 회원가입(Register) 핸들러
+ *
+ * 흐름:
+ *   1) 입력 검증 (email, password 필수 + 길이)
+ *   2) 비밀번호 정책 검증 (password-policy.ts)
+ *   3) 이메일 중복 확인 (entityServer.find)
+ *   4) 비밀번호 해시 → account 엔티티 생성 (entityServer.submit)
+ *   5) email-verify.enabled=true → email-verify의 sendVerification 호출 (중복 코드 없음)
+ *      send_welcome_email=true    → 환영 메일 발송 (인증 메일과 병렬)
+ *   6) 201 반환
+ *
+ * 기존 entity-server 회원가입 구현을 대체한다.
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { ok, fail, entityServer, logger, sendEmail } from "@gateway/api";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TEMPLATES_DIR = join(__dirname, "..", "templates");
+import { validatePassword } from "@gateway/api";
+import { hashPassword } from "../../password-reset/password-utils.ts";
+import { loadEmailVerifyConfig } from "../../email-verify/config-loader.ts";
+import { sendVerification } from "../../email-verify/handlers/index.ts";
+import type {
+    RegisterConfig,
+    RegisterBody,
+    AccountFields,
+} from "./types/index.ts";
+
+/* ──────────── 상수 ──────────── */
+
+const MAX_EMAIL_LEN = 320;
+const MAX_PASSWD_LEN = 128;
+
+/* ──────────── 유틸 ──────────── */
+
+function nowIsoString(): string {
+    return new Date().toISOString();
+}
+
+/* ──────────── 핸들러 팩토리 ──────────── */
+
+export function createRegisterHandler(cfg: RegisterConfig) {
+    return async function handleRegister(
+        req: FastifyRequest<{ Body: RegisterBody }>,
+        reply: FastifyReply,
+    ): Promise<void> {
+        const body = req.body ?? {};
+
+        // ── 1. 입력 검증 ────────────────────────────────────────────────────
+        const email = (body.email ?? "").trim().toLowerCase();
+        const password = (body.password ?? "").trim();
+
+        if (!email) {
+            reply.code(400).send(fail("email is required"));
+            return;
+        }
+        if (!password) {
+            reply.code(400).send(fail("password is required"));
+            return;
+        }
+        if (email.length > MAX_EMAIL_LEN) {
+            reply.code(400).send(fail("email is too long"));
+            return;
+        }
+        if (password.length > MAX_PASSWD_LEN) {
+            reply.code(400).send(fail("password is too long"));
+            return;
+        }
+        if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(email)) {
+            reply.code(400).send(fail("email format is invalid"));
+            return;
+        }
+
+        // ── 2. 비밀번호 정책 검증 ────────────────────────────────────────────
+        // validatePassword 내부에서 policy.enabled 확인
+        const policyError = validatePassword(password);
+        if (policyError) {
+            reply.code(400).send(fail(policyError));
+            return;
+        }
+
+        // ── 3. 이메일 중복 확인 ──────────────────────────────────────────────
+        try {
+            const existing = await entityServer.find<AccountFields>("account", {
+                email,
+            });
+            if (existing?.data) {
+                reply.code(409).send(fail("이미 사용 중인 이메일입니다."));
+                return;
+            }
+        } catch {
+            // find가 404를 던지면 중복 없는 것으로 처리
+        }
+
+        // ── 4. 계정 생성 ─────────────────────────────────────────────────────
+        const passwdHash = hashPassword(password);
+
+        // email-verify 설정을 미리 로드해서 email_verified 초기값 결정
+        const emailVerifyCfg = loadEmailVerifyConfig();
+        const willSendVerify = emailVerifyCfg.enabled;
+
+        // 허용된 추가 필드 전달 (보안 필드는 제외)
+        const blockedKeys = new Set([
+            "email",
+            "password",
+            "passwd",
+            "status",
+            "rbac_role",
+            "has_password",
+            "email_verified",
+            "seq",
+            "email_verify_code",
+            "email_verify_expires_time",
+        ]);
+        const extra: Record<string, unknown> = {};
+        for (const [k, v] of Object.entries(body)) {
+            if (!blockedKeys.has(k)) extra[k] = v;
+        }
+
+        const submitData: Record<string, unknown> = {
+            email,
+            passwd: passwdHash,
+            passwd_changed_time: nowIsoString(),
+            status: "active",
+            rbac_role: cfg.default_role,
+            has_password: true,
+            // 인증 메일을 보내면 false(미인증), 아니면 true(인증 불필요)
+            email_verified: !willSendVerify,
+            ...extra,
+        };
+
+        let newSeq: number;
+        try {
+            const result = await entityServer.submit("account", submitData);
+            newSeq = result.seq;
+            if (!newSeq) throw new Error("seq not returned");
+        } catch (err) {
+            logger.error({ email, err }, "Register: account creation failed");
+            reply.code(500).send(fail("계정 생성에 실패했습니다."));
+            return;
+        }
+
+        logger.info({ email, seq: newSeq }, "Register: account created");
+
+        // ── 5. 이메일 발송 (비동기 — 응답을 블로킹하지 않음) ──────────────────
+        const emailJobs: Promise<void>[] = [];
+
+        if (willSendVerify) {
+            // email-verify ON → 인증 메일 발송 (환영 메일은 인증 완료 후 confirm/activate에서 발송)
+            const method: "code" | "link" = emailVerifyCfg.link_base_url
+                ? "link"
+                : "code";
+            emailJobs.push(
+                sendVerification(emailVerifyCfg, newSeq, email, method),
+            );
+        } else if (cfg.send_welcome_email) {
+            // email-verify OFF → 인증 불필요, 즉시 환영 메일 발송
+            emailJobs.push(
+                sendWelcomeEmail(cfg, email, body.name as string | undefined),
+            );
+        }
+
+        // 발송 실패는 로그만 남기고 201 응답에 영향 없음
+        Promise.all(emailJobs).catch((err) =>
+            logger.error(
+                { email, seq: newSeq, err },
+                "Register: email send failed",
+            ),
+        );
+
+        // ── 6. 응답 ──────────────────────────────────────────────────────────
+        reply.code(201).send(
+            ok({
+                seq: newSeq,
+                email,
+                email_verified: !willSendVerify,
+            }),
+        );
+    };
+}
+
+/* ──────────── 환영 메일 발송 ──────────── */
+
+export async function sendWelcomeEmail(
+    cfg: RegisterConfig,
+    email: string,
+    name?: string,
+): Promise<void> {
+    try {
+        await sendEmail({
+            to: [email],
+            subject: cfg.welcome_email_subject,
+            templateDir: TEMPLATES_DIR,
+            templateName: "welcome",
+            templateData: { email, name: name ?? email },
+            refEntity: "account",
+        });
+        logger.info({ email }, "Register: welcome email sent");
+    } catch (err) {
+        logger.error({ email, err }, "Register: sendWelcomeEmail failed");
+        throw err;
+    }
+}

package/src/app/routes/account/register/routes.ts

@@ -0,0 +1,25 @@
+/**
+ * 회원가입(Register) 라우트 서브 플러그인
+ *
+ * `routes/account/routes.ts`에서 prefix `/register`로 등록된다.
+ * 최종 엔드포인트: POST /api/v1/account/register
+ *
+ * 가입 후 이메일 인증 발송 또는 환영 메일 발송을 config.json으로 제어한다.
+ */
+
+import type { FastifyInstance } from "fastify";
+import { loadRegisterConfig } from "./config-loader.ts";
+import { createRegisterHandler } from "./handlers.ts";
+
+export default async function registerPlugin(
+    app: FastifyInstance,
+): Promise<void> {
+    const cfg = loadRegisterConfig();
+
+    if (!cfg.enabled) {
+        return;
+    }
+
+    // POST /api/v1/account/register
+    app.post("/", createRegisterHandler(cfg));
+}

package/src/app/routes/account/register/types/index.ts

@@ -0,0 +1,50 @@
+/**
+ * 회원가입(Register) — 요청/응답 타입 정의
+ */
+
+/* ──────────── 설정 ──────────── */
+
+export interface RegisterConfig {
+    /** 기능 활성화 여부 (기본: true) */
+    enabled: boolean;
+    /**
+     * 가입 환영 메일 발송 여부
+     * 인증 이메일 발송 여부는 email-verify/config.json의 enabled 필드로 제어.
+     */
+    send_welcome_email: boolean;
+    /** 가입 환영 메일 제목 */
+    welcome_email_subject: string;
+    /** 가입 허용 RBAC role (기본: "user") */
+    default_role: string;
+    /** 빌드 시 dist에 포함 여부 (기본: true, false면 배포에서 제외) */
+    deploy?: boolean;
+    /** 빌드 시 난독화 여부 */
+    minify?: boolean;
+}
+
+/* ──────────── 요청 ──────────── */
+
+export interface RegisterBody {
+    /** 이메일 (필수) */
+    email: string;
+    /** 비밀번호 (필수) */
+    password: string;
+    /** 이름 (선택) */
+    name?: string;
+    /** 전화번호 (선택) */
+    phone?: string;
+    /** 추가 필드는 account 엔티티에 그대로 전달 */
+    [key: string]: unknown;
+}
+
+/* ──────────── Account 엔티티 필드 ──────────── */
+
+export interface AccountFields {
+    seq: number;
+    email?: string;
+    email_verified?: boolean;
+    email_verify_code?: string | null;
+    email_verify_expires_time?: string | null;
+    status?: string;
+    rbac_role?: string;
+}

package/src/app/routes/account/routes.ts

@@ -0,0 +1,31 @@
+/**
+ * Account 라우트 플러그인
+ *
+ * 자동 로더가 `app/routes/account/routes.ts`를 탐색하여
+ * prefix `/api/v1/account` 으로 등록한다.
+ *
+ * 하위 라우트:
+ *   POST /register         → POST /api/v1/account/register
+ *   POST /withdraw         → POST /api/v1/account/withdraw
+ *   POST /change-password  → POST /api/v1/account/change-password
+ *   POST /reactivate       → POST /api/v1/account/reactivate
+ *   *    /2fa/*            → /api/v1/account/2fa/* (2FA TOTP)
+ *   *    /oauth/*          → /api/v1/account/oauth/* (OAuth 연동 관리)
+ */
+
+import type { FastifyInstance } from "fastify";
+import registerRoutes from "./register/routes.ts";
+import withdrawPlugin from "./withdraw/routes.ts";
+import changePasswordPlugin from "./change-password/routes.ts";
+import reactivatePlugin from "./reactivate/routes.ts";
+
+export default async function accountRoutes(
+    app: FastifyInstance,
+): Promise<void> {
+    await app.register(registerRoutes, { prefix: "/register" });
+    await app.register(withdrawPlugin, { prefix: "/withdraw" });
+    await app.register(changePasswordPlugin, { prefix: "/change-password" });
+    await app.register(reactivatePlugin, { prefix: "/reactivate" });
+    // 2FA → plugins/2fa/index.ts 에서 /api/v1/account/2fa/* 로 등록
+    // OAuth 연동 → plugins/oauth/index.ts 에서 /api/v1/account/oauth/* 로 등록
+}

package/src/app/routes/account/templates/force_reset.html

@@ -0,0 +1,18 @@
+<h2 style="margin: 0 0 16px; font-size: 22px; font-weight: 700; color: #1a1a2e;">임시 비밀번호 안내</h2>
+<p style="margin: 0 0 24px; font-size: 15px; color: #555; line-height: 1.6;">
+    관리자에 의해 비밀번호가 초기화되었습니다. 아래 임시 비밀번호로 로그인 후 즉시 비밀번호를 변경하세요.
+</p>
+<div style="text-align: center; margin: 0 0 28px;">
+    <div style="display: inline-block; padding: 14px 32px; background-color: #f4f4f7; border-radius: 8px; border: 1px solid #e0e0e0;">
+        <span style="font-size: 22px; font-weight: 700; letter-spacing: 4px; color: #1a1a2e; font-family: 'Courier New', Courier, monospace;">${temp_password|}</span>
+    </div>
+</div>
+<p style="margin: 0 0 16px; font-size: 14px; color: #d9534f; font-weight: 600; line-height: 1.6;">
+    ⚠ 보안을 위해 로그인 즉시 비밀번호를 변경하시기 바랍니다.
+</p>
+<p style="margin: 0 0 8px; font-size: 14px; color: #888; line-height: 1.6;">
+    이메일: <strong>${email|}</strong>
+</p>
+<p style="margin: 0; font-size: 13px; color: #aaa; line-height: 1.6;">
+    본인이 요청하지 않은 경우 즉시 관리자에게 문의하세요.
+</p>

package/src/app/routes/account/templates/welcome.html

@@ -0,0 +1,14 @@
+<h2 style="margin: 0 0 16px; font-size: 22px; font-weight: 700; color: #1a1a2e;">가입을 환영합니다!</h2>
+<p style="margin: 0 0 24px; font-size: 15px; color: #555; line-height: 1.6;">
+    <strong>${name|회원}</strong>님, 가입해 주셔서 감사합니다.<br>
+    아래 계정으로 서비스를 이용하실 수 있습니다.
+</p>
+<div style="padding: 16px 20px; background-color: #f4f4f7; border-radius: 8px; border: 1px solid #e0e0e0; margin: 0 0 24px;">
+    <p style="margin: 0; font-size: 14px; color: #555;">
+        <span style="color: #888;">이메일</span><br>
+        <strong style="font-size: 15px; color: #1a1a2e;">${email}</strong>
+    </p>
+</div>
+<p style="margin: 0; font-size: 13px; color: #aaa; line-height: 1.6;">
+    본인이 가입하지 않은 경우 이 이메일을 무시하거나 고객센터에 문의하세요.
+</p>