create-entity-app-server 0.0.3

package/src/app/routes/account/withdraw/handlers.ts

@@ -0,0 +1,111 @@
+/**
+ * 회원 탈퇴(Withdraw) 핸들러
+ *
+ * 흐름:
+ *   1) 탈퇴 전 이메일 미리 조회 (익명화되면 이메일을 알 수 없음)
+ *   2) 플러그인/라우트 withdraw hook 실행 (account_oauth, totp 필드 등 고아 데이터 정리)
+ *   3) Go /v1/auth/withdraw 프록시 (account 익명화 + JWT revoke)
+ *   4) 성공 시 탈퇴 확인 이메일 발송
+ *
+ * 플러그인 cleanup 등록:
+ *   plugins/oauth/index.ts  → registerWithdrawHook("oauth", ...)
+ *   plugins/2fa/index.ts    → registerWithdrawHook("2fa", ...)
+ */
+
+import type { FastifyRequest, FastifyReply } from "fastify";
+import { fail, entityServer, sendEmail, logger } from "@gateway/api";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const TEMPLATES_DIR = join(__dirname, "..", "templates");
+import { env } from "@gateway/api";
+import { runWithdrawHooks } from "@gateway/api";
+import { getAccountSeqFromJwt } from "../../email-verify/handlers/utils.ts";
+
+/* ──────────── 타입 ──────────── */
+
+interface AccountRow {
+    seq: number;
+    email?: string;
+}
+
+interface WithdrawBody {
+    passwd?: string;
+}
+
+/* ──────────── 핸들러 ──────────── */
+
+export async function handleWithdraw(
+    req: FastifyRequest<{ Body: WithdrawBody }>,
+    reply: FastifyReply,
+): Promise<void> {
+    // 1. JWT에서 account_seq 추출
+    const accountSeq = getAccountSeqFromJwt(req);
+    if (!accountSeq) {
+        reply.code(401).send(fail("인증이 필요합니다."));
+        return;
+    }
+
+    // 2. 탈퇴 전 이메일 미리 조회 (익명화되면 이메일을 알 수 없음)
+    let accountEmail = "";
+    try {
+        const res = await entityServer.get<AccountRow>("account", accountSeq);
+        accountEmail = res?.data?.email ?? "";
+    } catch {
+        // 조회 실패 시 이메일 없이 진행
+    }
+
+    // 3. 플러그인 cleanup (account_oauth, totp 필드 초기화 등)
+    await runWithdrawHooks(accountSeq, (msg, extra) =>
+        logger.warn({ ...extra }, `Withdraw: ${msg}`),
+    );
+
+    // 4. Go /v1/auth/withdraw 프록시 (account 익명화 + JWT revoke)
+    const goUrl = `${env.ENTITY_SERVER_URL}/v1/auth/withdraw`;
+    const authorization = req.headers.authorization ?? "";
+    let goResponse: Response;
+    let goBody: string;
+    try {
+        goResponse = await fetch(goUrl, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: authorization,
+            },
+            body: JSON.stringify(req.body ?? {}),
+            signal: AbortSignal.timeout(10_000),
+        });
+        goBody = await goResponse.text();
+    } catch (err) {
+        logger.error({ err, seq: accountSeq }, "Withdraw: Go proxy failed");
+        reply.code(502).send(fail("탈퇴 처리에 실패했습니다."));
+        return;
+    }
+
+    // 5. Go 응답 반환 (실패 시 그대로 전달)
+    reply.code(goResponse.status);
+    try {
+        reply.type("application/json").send(goBody);
+    } catch {
+        reply.send(goBody);
+    }
+
+    // 6. 성공 시 탈퇴 확인 이메일 발송 (fire-and-forget)
+    if (goResponse.ok && accountEmail) {
+        sendEmail({
+            to: [accountEmail],
+            subject: "회원 탈퇴 완료 안내",
+            templateDir: TEMPLATES_DIR,
+            templateName: "withdraw_complete",
+            templateData: { email: accountEmail },
+        }).catch((err) =>
+            logger.warn(
+                { err, seq: accountSeq },
+                "Withdraw: email send failed",
+            ),
+        );
+    }
+
+    logger.info({ seq: accountSeq, ok: goResponse.ok }, "Withdraw: processed");
+}

package/src/app/routes/account/withdraw/routes.ts

@@ -0,0 +1,18 @@
+/**
+ * 회원 탈퇴(Withdraw) 라우트 서브 플러그인
+ *
+ * `routes/account/routes.ts`에서 prefix `/withdraw`로 등록된다.
+ * 최종 엔드포인트: POST /api/v1/account/withdraw
+ *
+ * JWT 인증이 필요한 보호 라우트.
+ */
+
+import type { FastifyInstance } from "fastify";
+import { handleWithdraw } from "./handlers.ts";
+
+export default async function withdrawPlugin(
+    app: FastifyInstance,
+): Promise<void> {
+    // POST /api/v1/account/withdraw  (JWT 필요)
+    app.post("/", handleWithdraw);
+}

package/src/app/routes/approval/config.json

@@ -0,0 +1,5 @@
+{
+    "enabled": false,
+    "deploy": true,
+    "minify": false
+}

package/src/app/routes/approval/entities/approval.json

@@ -0,0 +1,99 @@
+{
+    "name": "approval",
+    "description": "결재 문서 정보. JWT 인증 시 account_seq ↔ account 관계. 사용자 환경에 맞게 fields를 자유롭게 확장할 수 있습니다.",
+    "fields": {
+        "account_seq": {
+            "index": true,
+            "comment": "작성자 account seq (JWT 인증 시. HMAC은 nullable)"
+        },
+        "created_by": {
+            "index": true,
+            "comment": "생성자 user seq (시스템/호환)",
+            "type": "uint",
+            "required": true
+        },
+        "doc_no": {
+            "index": true,
+            "comment": "문서번호",
+            "unique": true
+        },
+        "importance": {
+            "index": true,
+            "comment": "중요도",
+            "type": [
+                "긴급",
+                "높음",
+                "보통",
+                "낮음"
+            ],
+            "default": "보통"
+        },
+        "status": {
+            "index": true,
+            "comment": "결재 상태",
+            "type": [
+                "대기",
+                "진행",
+                "승인",
+                "반려",
+                "취소"
+            ],
+            "default": "대기",
+            "required": true
+        },
+        "title": {
+            "index": true,
+            "comment": "제목"
+        },
+        "type": {
+            "index": true,
+            "comment": "결재 유형",
+            "type": [
+                "vacation",
+                "overtime",
+                "expense",
+                "purchase",
+                "supply",
+                "business_trip",
+                "vehicle",
+                "education",
+                "certificate",
+                "proposal",
+                "draft",
+                "report",
+                "cooperation",
+                "meeting_minutes",
+                "contract",
+                "congratulation",
+                "project",
+                "other"
+            ],
+            "required": true
+        },
+        "user_name": {
+            "index": true,
+            "comment": "작성자명"
+        },
+        "approved_time": {
+            "comment": "승인일시"
+        },
+        "content": {
+            "comment": "내용"
+        },
+        "data": {
+            "comment": "양식별 데이터 (JSON)"
+        },
+        "deadline": {
+            "comment": "결재기한"
+        },
+        "retention_period": {
+            "comment": "문서보존기한"
+        },
+        "user_department": {
+            "comment": "작성자 부서"
+        },
+        "user_position": {
+            "comment": "작성자 직급"
+        }
+    }
+}

package/src/app/routes/approval/entities/comments.json

@@ -0,0 +1,17 @@
+{
+    "name": "approval_comments",
+    "description": "결재 의견 정보. 사용자 환경에 맞게 fields를 자유롭게 확장할 수 있습니다.",
+    "fields": {
+        "approval_seq": {
+            "index": true,
+            "comment": "결재seq",
+            "required": true
+        },
+        "content": {
+            "required": true
+        },
+        "created_by": {
+            "required": true
+        }
+    }
+}

package/src/app/routes/approval/entities/reference.json

@@ -0,0 +1,16 @@
+{
+    "name": "approval_reference",
+    "description": "결재 참조자 정보. 사용자 환경에 맞게 fields를 자유롭게 확장할 수 있습니다.",
+    "fields": {
+        "approval_seq": {
+            "index": true,
+            "comment": "결재seq",
+            "required": true
+        },
+        "name": {
+            "index": true,
+            "comment": "참조자명",
+            "required": true
+        }
+    }
+}

package/src/app/routes/approval/routes.ts

@@ -0,0 +1,30 @@
+/**
+ * Approval 라우트 플러그인
+ *
+ * 자동 로더가 `app/routes/approval/routes.ts`를 탐색하여
+ * prefix `/api/v1/approval` 으로 등록한다.
+ *
+ * 엔티티:
+ *   - approval        — 결재 문서
+ *   - approval_files  — 결재 첨부파일
+ *   - comments        — 결재 의견/코멘트
+ *   - reference       — 결재 참조자
+ */
+
+import type { FastifyInstance } from "fastify";
+import { dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+import { logger, ensurePluginEntities } from "@gateway/api";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+export default async function approvalRoutes(
+    app: FastifyInstance,
+): Promise<void> {
+    await ensurePluginEntities(__dirname).catch((err) =>
+        logger.warn({ err }, "approval: ensureEntities failed"),
+    );
+
+    // TODO: 결재 라우트 핸들러 추가
+    void app;
+}

package/src/app/routes/auth/config.json

@@ -0,0 +1,5 @@
+{
+    "enabled": true,
+    "deploy": true,
+    "minify": false
+}

package/src/app/routes/auth/handlers.ts

@@ -0,0 +1,245 @@
+/**
+ * 휴면 계정 재활성화 핸들러
+ *
+ * Go `POST /v1/auth/reactivate` 대체 구현.
+ * 이메일+비밀번호 또는 OAuth code 로 본인 확인 후 account.status 를 `active`로 복구하고
+ * JWT 토큰 쌍을 즉시 발급한다.
+ */
+
+import type { FastifyReply, FastifyRequest } from "fastify";
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { entityServer, fail, logger, ok } from "@gateway/api";
+import { issueTokenPair } from "../../plugins/2fa/handlers/utils.ts";
+import { getProvider, buildCallbackUrl } from "../../plugins/oauth/config.ts";
+import { validateState } from "../../plugins/oauth/state.ts";
+import {
+    exchangeCode,
+    getUserInfo,
+} from "../../plugins/oauth/providers/index.ts";
+import { upsertOAuthAccount } from "../../plugins/oauth/upsert.ts";
+import type {
+    AccountTotpFields,
+    TwoFactorConfig,
+} from "../../plugins/2fa/types.ts";
+import { verifyPassword } from "../password-reset/password-utils.ts";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+
+interface ReactivateBody {
+    email?: string;
+    passwd?: string;
+    provider?: string;
+    code?: string;
+    state?: string;
+    redirect_uri?: string;
+}
+
+interface ReactivateAccount extends AccountTotpFields {
+    status?: string;
+    dormancy_warned_days?: number;
+}
+
+function loadTokenConfig(): TwoFactorConfig {
+    const configPath = resolve(
+        __dirname,
+        "..",
+        "..",
+        "plugins",
+        "2fa",
+        "config.json",
+    );
+    let raw: Record<string, unknown> = {};
+
+    if (existsSync(configPath)) {
+        const text = readFileSync(configPath, "utf-8").replace(
+            /\$\{([^}]+)\}/g,
+            (_m, name: string) => process.env[name] ?? "",
+        );
+        raw = JSON.parse(text) as Record<string, unknown>;
+    }
+
+    return {
+        enabled: raw.enabled !== false,
+        issuer: String(raw.issuer ?? "EntityServer"),
+        code_digits: Number(raw.code_digits) || 6,
+        period_sec: Number(raw.period_sec) || 30,
+        skew: Number(raw.skew) ?? 1,
+        recovery_code_count: Number(raw.recovery_code_count) || 10,
+        setup_token_ttl_sec: Number(raw.setup_token_ttl_sec) || 300,
+        max_verify_attempts: Number(raw.max_verify_attempts) || 5,
+        verify_lockout_sec: Number(raw.verify_lockout_sec) || 300,
+        jwt_access_ttl_sec: Number(raw.jwt_access_ttl_sec) || 3600,
+        jwt_refresh_ttl_sec: Number(raw.jwt_refresh_ttl_sec) || 1209600,
+        jwt_issuer: String(raw.jwt_issuer ?? "entity-server"),
+    };
+}
+
+function nowSqlString(): string {
+    return new Date()
+        .toISOString()
+        .replace("T", " ")
+        .replace(/\.\d+Z$/, "");
+}
+
+async function verifyOAuthOwnership(
+    body: ReactivateBody,
+    email: string,
+    accountSeq: number,
+): Promise<ReactivateAccount | null> {
+    const provider = (body.provider ?? "").trim().toLowerCase();
+    const code = (body.code ?? "").trim();
+    if (!provider || !code) return null;
+    if (!getProvider(provider)) {
+        throw new Error(`Unsupported OAuth provider: ${provider}`);
+    }
+
+    let codeVerifier: string | undefined;
+    if (body.state) {
+        ({ codeVerifier } = validateState(body.state, provider));
+    }
+
+    const token = await exchangeCode({
+        provider,
+        code,
+        redirectUri: body.redirect_uri || buildCallbackUrl(provider),
+        codeVerifier,
+    });
+    const userInfo = await getUserInfo(provider, token);
+
+    if (!userInfo.email) {
+        throw new Error("OAuth provider did not return an email address");
+    }
+    if (userInfo.email.toLowerCase() !== email.toLowerCase()) {
+        throw new Error("OAuth email does not match account email");
+    }
+
+    const linkedAccount = await upsertOAuthAccount(userInfo);
+    if (Number(linkedAccount.seq) !== accountSeq) {
+        throw new Error(
+            "This OAuth account is already linked to another account",
+        );
+    }
+
+    return linkedAccount as ReactivateAccount;
+}
+
+export async function handleReactivate(
+    req: FastifyRequest<{ Body: ReactivateBody }>,
+    reply: FastifyReply,
+): Promise<void> {
+    const email = (req.body?.email ?? "").trim();
+    const passwd = (req.body?.passwd ?? "").trim();
+    const provider = (req.body?.provider ?? "").trim().toLowerCase();
+    const code = (req.body?.code ?? "").trim();
+
+    if (!email) {
+        reply.code(400).send(fail("email is required"));
+        return;
+    }
+    if (!passwd && !(provider && code)) {
+        reply.code(400).send(fail("passwd or (provider and code) is required"));
+        return;
+    }
+
+    let account: ReactivateAccount | null = null;
+    try {
+        const result = await entityServer.find<ReactivateAccount>("account", {
+            email,
+        });
+        account = result?.data ?? null;
+    } catch {
+        account = null;
+    }
+
+    if (!account) {
+        reply.code(404).send(fail("Account not found"));
+        return;
+    }
+
+    const status = String(account.status ?? "");
+    if (status !== "dormant") {
+        if (status === "active") {
+            reply.code(409).send(fail("Account is already active"));
+            return;
+        }
+        reply
+            .code(403)
+            .send(fail(`Account cannot be reactivated (status: ${status})`));
+        return;
+    }
+
+    let tokenAccount = account;
+
+    if (provider && code) {
+        try {
+            const linkedAccount = await verifyOAuthOwnership(
+                req.body ?? {},
+                email,
+                Number(account.seq),
+            );
+            if (linkedAccount) {
+                tokenAccount = { ...account, ...linkedAccount };
+            }
+        } catch (err) {
+            logger.warn(
+                { err, email, provider },
+                "Auth reactivate: OAuth verification failed",
+            );
+            const message =
+                err instanceof Error
+                    ? err.message
+                    : "OAuth verification failed";
+            const statusCode = message.startsWith("Unsupported OAuth provider")
+                ? 400
+                : message ===
+                    "This OAuth account is already linked to another account"
+                  ? 409
+                  : 401;
+            reply.code(statusCode).send(fail(message));
+            return;
+        }
+    } else {
+        if (!account.passwd || !verifyPassword(passwd, account.passwd)) {
+            reply.code(401).send(fail("Invalid password"));
+            return;
+        }
+    }
+
+    try {
+        await entityServer.submit("account", {
+            seq: account.seq,
+            status: "active",
+            last_login_time: nowSqlString(),
+            dormancy_warned_days: 0,
+        });
+    } catch (err) {
+        logger.error(
+            { err, accountSeq: account.seq },
+            "Auth reactivate: failed to update account",
+        );
+        reply.code(500).send(fail("Failed to reactivate account"));
+        return;
+    }
+
+    const tokenPair = issueTokenPair(
+        {
+            ...tokenAccount,
+            name: tokenAccount.name ?? tokenAccount.email,
+            rbac_role: (tokenAccount.rbac_role ?? "").trim() || "user",
+            license_seq: Number(tokenAccount.license_seq ?? 0),
+        },
+        loadTokenConfig(),
+    );
+
+    logger.info(
+        { accountSeq: account.seq, email },
+        "Auth reactivate: account reactivated",
+    );
+
+    reply
+        .header("X-Access-Token", tokenPair.access_token)
+        .header("X-Refresh-Token", tokenPair.refresh_token)
+        .send(ok(tokenPair));
+}

package/src/app/routes/auth/routes.ts

@@ -0,0 +1,16 @@
+/**
+ * 인증(Auth) 라우트 플러그인
+ *
+ * 자동 로더가 `app/routes/auth/routes.ts`를 탐색하여
+ * prefix `/api/v1/auth` 으로 등록한다.
+ *
+ * 엔드포인트:
+ *   POST /reactivate  — 휴면 계정 재활성화 (비보호)
+ */
+
+import type { FastifyInstance } from "fastify";
+import { handleReactivate } from "./handlers.ts";
+
+export default async function authRoutes(app: FastifyInstance): Promise<void> {
+    app.post("/reactivate", handleReactivate);
+}

package/src/app/routes/board/config.json

@@ -0,0 +1,5 @@
+{
+    "enabled": true,
+    "deploy": true,
+    "minify": false
+}

package/src/app/routes/board/entities/board_category.json

@@ -0,0 +1,90 @@
+{
+    "name": "board_category",
+    "description": "게시판 카테고리 (게시판 종류 정의)",
+    "fields": {
+        "name": {
+            "index": true,
+            "required": true,
+            "unique": true,
+            "comment": "게시판 이름 (예: notice, free, qna)"
+        },
+        "label": {
+            "required": true,
+            "comment": "표시 이름 (예: 공지사항, 자유게시판)"
+        },
+        "description": {
+            "comment": "게시판 설명"
+        },
+        "status": {
+            "index": true,
+            "type": ["active", "inactive"],
+            "default": "active",
+            "comment": "게시판 활성 상태"
+        },
+        "sort_order": {
+            "type": "uint",
+            "default": "0",
+            "comment": "정렬 순서"
+        },
+        "read_role": {
+            "type": ["all", "member", "admin"],
+            "default": "all",
+            "comment": "읽기 권한"
+        },
+        "write_role": {
+            "type": ["all", "member", "admin"],
+            "default": "member",
+            "comment": "쓰기 권한"
+        },
+        "reply_enabled": {
+            "type": ["Y", "N"],
+            "default": "Y",
+            "comment": "답글 허용 여부"
+        },
+        "comment_enabled": {
+            "type": ["Y", "N"],
+            "default": "Y",
+            "comment": "댓글 허용 여부"
+        },
+        "file_enabled": {
+            "type": ["Y", "N"],
+            "default": "Y",
+            "comment": "파일 첨부 허용 여부"
+        },
+        "guest_write_enabled": {
+            "type": ["Y", "N"],
+            "default": "N",
+            "comment": "비회원 글작성 허용 여부 (비밀번호 인증)"
+        },
+        "like_enabled": {
+            "type": ["Y", "N"],
+            "default": "N",
+            "comment": "좋아요/추천 허용 여부"
+        },
+        "rating_enabled": {
+            "type": ["Y", "N"],
+            "default": "N",
+            "comment": "별점 허용 여부"
+        },
+        "accept_enabled": {
+            "type": ["Y", "N"],
+            "default": "N",
+            "comment": "답변 채택 허용 여부 (Q&A 게시판용)"
+        },
+        "push_on_write": {
+            "type": ["Y", "N"],
+            "default": "N",
+            "comment": "글 등록 시 관리자 push 알림 여부 (문의게시판 등)"
+        },
+        "view_count_mode": {
+            "type": ["always", "session", "daily", "once"],
+            "default": "daily",
+            "comment": "조회수 카운트 방식. always=매 조회, session=세션당 1회, daily=1일 1인 1회(기본), once=1인 1회(영구)"
+        },
+        "anonymous_enabled": {
+            "type": ["Y", "N"],
+            "default": "N",
+            "comment": "익명 게시판 여부. Y이면 작성자 표시를 '익명'으로 강제, user_seq는 응답에서 숨김"
+        }
+    }
+}