Authentication

// JWT 인증 미들웨어 - Node.js Express + Passport
const express = require('express');
const passport = require('passport');
const { Strategy: JwtStrategy, ExtractJwt } = require('passport-jwt');
const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');

const app = express();
app.use(express.json());

// 설정
const JWT_SECRET = process.env.JWT_SECRET || 'your-secret-key';
const JWT_EXPIRES_IN = '30m';

// 가상 데이터베이스
const users = new Map();

// Passport JWT 전략 설정
const jwtOptions = {
    jwtFromRequest: ExtractJwt.fromAuthHeaderAsBearerToken(),
    secretOrKey: JWT_SECRET,
};

passport.use(new JwtStrategy(jwtOptions, async (payload, done) => {
    try {
        const user = users.get(payload.sub);
        if (user) {
            return done(null, user);
        }
        return done(null, false);
    } catch (error) {
        return done(error, false);
    }
}));

app.use(passport.initialize());

// 인증 미들웨어
const authenticate = passport.authenticate('jwt', { session: false });

// 회원가입
app.post('/register', async (req, res) => {
    const { username, email, password } = req.body;

    if (users.has(username)) {
        return res.status(400).json({ error: 'User already exists' });
    }

    // 비밀번호 해싱 (bcrypt, cost factor 12)
    const hashedPassword = await bcrypt.hash(password, 12);

    const user = {
        id: Date.now().toString(),
        username,
        email,
        hashedPassword,
        createdAt: new Date(),
    };

    users.set(username, user);
    res.status(201).json({ message: 'User created', username });
});

// 로그인
app.post('/login', async (req, res) => {
    const { username, password } = req.body;

    const user = users.get(username);
    if (!user) {
        return res.status(401).json({ error: 'Invalid credentials' });
    }

    // 비밀번호 검증
    const isValid = await bcrypt.compare(password, user.hashedPassword);
    if (!isValid) {
        return res.status(401).json({ error: 'Invalid credentials' });
    }

    // JWT 토큰 생성
    const token = jwt.sign(
        {
            sub: user.username,
            email: user.email,
            iat: Math.floor(Date.now() / 1000),
        },
        JWT_SECRET,
        { expiresIn: JWT_EXPIRES_IN }
    );

    res.json({
        access_token: token,
        token_type: 'Bearer',
        expires_in: JWT_EXPIRES_IN,
    });
});

// 보호된 라우트 - 사용자 정보
app.get('/me', authenticate, (req, res) => {
    const { hashedPassword, ...userInfo } = req.user;
    res.json(userInfo);
});

// 보호된 라우트 - ML 추론 API
app.post('/api/ml/predict', authenticate, (req, res) => {
    const { input } = req.body;

    // ML 추론 로직 (예시)
    const prediction = {
        user: req.user.username,
        input,
        result: Math.random(),
        confidence: 0.95,
        timestamp: new Date(),
    };

    res.json(prediction);
});

// 토큰 갱신
app.post('/refresh', authenticate, (req, res) => {
    const newToken = jwt.sign(
        { sub: req.user.username, email: req.user.email },
        JWT_SECRET,
        { expiresIn: JWT_EXPIRES_IN }
    );

    res.json({ access_token: newToken, token_type: 'Bearer' });
});

app.listen(3000, () => console.log('Server running on port 3000'));

# OAuth 2.0 Authorization Code Flow (PKCE)

# 1. 클라이언트: PKCE 코드 생성
# code_verifier: 43-128자 랜덤 문자열
CODE_VERIFIER=$(openssl rand -base64 32 | tr -d /=+ | cut -c -43)
# code_challenge: code_verifier의 SHA256 해시 (Base64URL 인코딩)
CODE_CHALLENGE=$(echo -n $CODE_VERIFIER | openssl sha256 -binary | base64 | tr +/ -_ | tr -d =)

echo "Code Verifier: $CODE_VERIFIER"
echo "Code Challenge: $CODE_CHALLENGE"

# 2. 사용자를 인증 서버로 리다이렉트 (Authorization Request)
# 브라우저에서 이 URL로 이동
AUTH_URL="https://auth.example.com/authorize?\
response_type=code&\
client_id=my-ml-app&\
redirect_uri=http://localhost:3000/callback&\
scope=openid%20profile%20email%20ml.predict&\
state=random-state-string&\
code_challenge=$CODE_CHALLENGE&\
code_challenge_method=S256"

echo "Authorization URL: $AUTH_URL"

# 3. 사용자 인증 후 콜백으로 authorization_code 수신
# http://localhost:3000/callback?code=AUTH_CODE&state=random-state-string

# 4. Authorization Code를 Access Token으로 교환
AUTH_CODE="received-auth-code"

curl -X POST https://auth.example.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=authorization_code" \
  -d "code=$AUTH_CODE" \
  -d "redirect_uri=http://localhost:3000/callback" \
  -d "client_id=my-ml-app" \
  -d "code_verifier=$CODE_VERIFIER"

# 응답 예시:
# {
#   "access_token": "eyJhbGciOiJSUzI1NiIs...",
#   "token_type": "Bearer",
#   "expires_in": 3600,
#   "refresh_token": "dGhpcyBpcyBhIHJlZnJlc2g...",
#   "id_token": "eyJhbGciOiJSUzI1NiIs...",
#   "scope": "openid profile email ml.predict"
# }

# 5. Access Token으로 API 호출
ACCESS_TOKEN="eyJhbGciOiJSUzI1NiIs..."

curl -X POST https://api.example.com/ml/predict \
  -H "Authorization: Bearer $ACCESS_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"input": [1.0, 2.0, 3.0]}'

# 6. Refresh Token으로 새 Access Token 발급
REFRESH_TOKEN="dGhpcyBpcyBhIHJlZnJlc2g..."

curl -X POST https://auth.example.com/oauth/token \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -d "grant_type=refresh_token" \
  -d "refresh_token=$REFRESH_TOKEN" \
  -d "client_id=my-ml-app"

# 7. 토큰 검증 (Introspection)
curl -X POST https://auth.example.com/oauth/introspect \
  -H "Content-Type: application/x-www-form-urlencoded" \
  -u "my-ml-app:client-secret" \
  -d "token=$ACCESS_TOKEN"